{"matches":[{"vulnerability":{"id":"GHSA-96hv-2xvq-fx4p","dataSource":"https://github.com/advisories/GHSA-96hv-2xvq-fx4p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://nvd.nist.gov/vuln/detail/CVE-2026-48779","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://access.redhat.com/security/cve/CVE-2026-48779","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:26638"],"description":"ws: Memory exhaustion DoS from tiny fragments and data chunks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":1.0695},"relatedVulnerabilities":[{"id":"CVE-2026-48779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-48779","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"],"description":"ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"7.5.10"}},"found":{"vulnerabilityID":"GHSA-96hv-2xvq-fx4p","versionConstraint":">=7.0.0,<7.5.11 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/ws@7.5.10?package-id=c8b46866a7d817d0","name":"ws","version":"7.5.10","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:7.5.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@7.5.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-96hv-2xvq-fx4p","dataSource":"https://github.com/advisories/GHSA-96hv-2xvq-fx4p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://nvd.nist.gov/vuln/detail/CVE-2026-48779","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://access.redhat.com/security/cve/CVE-2026-48779","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:26638"],"description":"ws: Memory exhaustion DoS from tiny fragments and data chunks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.21.0"],"state":"fixed","available":[{"version":"8.21.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":1.0695},"relatedVulnerabilities":[{"id":"CVE-2026-48779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-48779","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"],"description":"ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.19.0"}},"found":{"vulnerabilityID":"GHSA-96hv-2xvq-fx4p","versionConstraint":">=8.0.0,<8.21.0 (semantic)"},"fix":{"suggestedVersion":"8.21.0"}}],"artifact":{"id":"pkg:npm/ws@8.19.0?package-id=239cba1a77cea730","name":"ws","version":"8.19.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:8.19.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.19.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-587h-7wmj-h5pm","dataSource":"https://github.com/advisories/GHSA-587h-7wmj-h5pm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm","https://nvd.nist.gov/vuln/detail/CVE-2026-112942","https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.2"],"state":"fixed","available":[{"version":"2.14.2","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.008},"relatedVulnerabilities":[{"id":"CVE-2026-112942","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"launch-editor","version":"2.13.1"}},"found":{"vulnerabilityID":"GHSA-587h-7wmj-h5pm","versionConstraint":"<=2.14.1 (semantic)"},"fix":{"suggestedVersion":"2.14.2"}}],"artifact":{"id":"pkg:npm/launch-editor@2.13.1?package-id=3137ee48630ee5a8","name":"launch-editor","version":"2.13.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:launch-editor:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch-editor:launch_editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch_editor:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch_editor:launch_editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch:launch_editor:2.13.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/launch-editor@2.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.0.6"],"state":"fixed","available":[{"version":"6.0.6","date":"2024-11-19","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":"<6.0.6 (semantic)"},"fix":{"suggestedVersion":"6.0.6"}}],"artifact":{"id":"pkg:npm/cross-spawn@5.1.0?package-id=a1dd805cb5a2ab28","name":"cross-spawn","version":"5.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:5.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4c8g-83qw-93j6","dataSource":"https://github.com/advisories/GHSA-4c8g-83qw-93j6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://nvd.nist.gov/vuln/detail/CVE-2026-13676","https://github.com/fastify/fast-uri/pull/188","https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05","https://github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd","https://github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json","https://github.com/fastify/fast-uri/releases/tag/v4.0.1","https://github.com/fastify/fast-uri/releases/tag/v3.1.3","https://github.com/fastify/fast-uri/releases/tag/v2.4.2","https://cna.openjsf.org/security-advisories.html","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://access.redhat.com/security/cve/CVE-2026-13676","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"description":"fast-uri vulnerable to host confusion via failed IDN canonicalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13676","epss":0.00692,"percentile":0.52908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13676","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-13676","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.519},"relatedVulnerabilities":[{"id":"CVE-2026-13676","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-13676","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json"],"description":"fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13676","epss":0.00692,"percentile":0.52908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13676","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-13676","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-4c8g-83qw-93j6","versionConstraint":">=3.0.0,<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7fh5-64p2-3v2j","dataSource":"https://github.com/advisories/GHSA-7fh5-64p2-3v2j","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-44270","https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5","https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25","https://github.com/postcss/postcss/releases/tag/8.4.31","https://github.com/github/advisory-database/issues/2820","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"],"description":"PostCSS line return parsing error","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-44270","epss":0.00973,"percentile":0.62033,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-44270","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["8.4.31"],"state":"fixed","available":[{"version":"8.4.31","date":"2023-10-04","kind":"first-observed"}]},"advisories":[],"risk":0.5010950000000001},"relatedVulnerabilities":[{"id":"CVE-2023-44270","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44270","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/github/advisory-database/issues/2820","https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25","https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5","https://github.com/postcss/postcss/releases/tag/8.4.31","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"],"description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-44270","epss":0.00973,"percentile":0.62033,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-44270","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"7.0.39"}},"found":{"vulnerabilityID":"GHSA-7fh5-64p2-3v2j","versionConstraint":"<8.4.31 (semantic)"},"fix":{"suggestedVersion":"8.4.31"}}],"artifact":{"id":"pkg:npm/postcss@7.0.39?package-id=6e0b8b643d46db35","name":"postcss","version":"7.0.39","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@7.0.39","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.28.1"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.28.1?package-id=7d3fad21a070a58f","name":"browserslist","version":"4.28.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.28.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.28.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.28.1"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.28.1?package-id=7d3fad21a070a58f","name":"browserslist","version":"4.28.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.28.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.28.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.12"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.12?package-id=300b7d6e5491c547","name":"brace-expansion","version":"1.1.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.2?package-id=f3c0dac3696b2b92","name":"brace-expansion","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-2wc2-fm75-p42x","dataSource":"https://github.com/advisories/GHSA-2wc2-fm75-p42x","namespace":"github:language:python","severity":"High","urls":["https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"],"description":"Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49476","epss":0.00644,"percentile":0.50875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49476","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49476","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.4"],"state":"fixed","available":[{"version":"2.8.4","date":"2026-07-09","kind":"first-observed"}]},"advisories":[],"risk":0.483},"relatedVulnerabilities":[{"id":"CVE-2026-49476","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49476","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/facelessuser/soupsieve/commit/28108ab805818c832d9568142a99844fd95a0d39","https://github.com/facelessuser/soupsieve/releases/tag/2.8.4","https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"],"description":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49476","epss":0.00644,"percentile":0.50875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49476","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49476","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"soupsieve","version":"2.8.3"}},"found":{"vulnerabilityID":"GHSA-2wc2-fm75-p42x","versionConstraint":"<=2.8.3 (python)"},"fix":{"suggestedVersion":"2.8.4"}}],"artifact":{"id":"pkg:pypi/soupsieve@2.8.3?package-id=758817c0cb884687","name":"soupsieve","version":"2.8.3","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:soupsieve:2.8.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/soupsieve@2.8.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-836r-79rf-4m37","dataSource":"https://github.com/advisories/GHSA-836r-79rf-4m37","namespace":"github:language:python","severity":"High","urls":["https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"],"description":"Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49477","epss":0.00644,"percentile":0.50875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49477","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49477","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.4"],"state":"fixed","available":[{"version":"2.8.4","date":"2026-07-09","kind":"first-observed"}]},"advisories":[],"risk":0.483},"relatedVulnerabilities":[{"id":"CVE-2026-49477","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49477","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/facelessuser/soupsieve/commit/eb4397618709186c109400448c6043b728217dc3","https://github.com/facelessuser/soupsieve/releases/tag/2.8.4","https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"],"description":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49477","epss":0.00644,"percentile":0.50875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49477","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49477","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"soupsieve","version":"2.8.3"}},"found":{"vulnerabilityID":"GHSA-836r-79rf-4m37","versionConstraint":"<=2.8.3 (python)"},"fix":{"suggestedVersion":"2.8.4"}}],"artifact":{"id":"pkg:pypi/soupsieve@2.8.3?package-id=758817c0cb884687","name":"soupsieve","version":"2.8.3","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:soupsieve:2.8.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/soupsieve@2.8.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.12"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.12?package-id=300b7d6e5491c547","name":"brace-expansion","version":"1.1.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.3"],"state":"fixed","available":[{"version":"2.1.3","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":">=2.0.0,<2.1.3 (semantic)"},"fix":{"suggestedVersion":"2.1.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.2?package-id=f3c0dac3696b2b92","name":"brace-expansion","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g55-p6wh-862q","dataSource":"https://github.com/advisories/GHSA-6g55-p6wh-862q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad","https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3","https://github.com/postcss/postcss/releases/tag/8.5.12"],"description":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["8.5.12"],"state":"fixed","available":[{"version":"8.5.12","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.45599999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-45623","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"7.0.39"}},"found":{"vulnerabilityID":"GHSA-6g55-p6wh-862q","versionConstraint":"<=8.5.11 (semantic)"},"fix":{"suggestedVersion":"8.5.12"}}],"artifact":{"id":"pkg:npm/postcss@7.0.39?package-id=6e0b8b643d46db35","name":"postcss","version":"7.0.39","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@7.0.39","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g55-p6wh-862q","dataSource":"https://github.com/advisories/GHSA-6g55-p6wh-862q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad","https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3","https://github.com/postcss/postcss/releases/tag/8.5.12"],"description":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["8.5.12"],"state":"fixed","available":[{"version":"8.5.12","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.45599999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-45623","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.6"}},"found":{"vulnerabilityID":"GHSA-6g55-p6wh-862q","versionConstraint":"<=8.5.11 (semantic)"},"fix":{"suggestedVersion":"8.5.12"}}],"artifact":{"id":"pkg:npm/postcss@8.5.6?package-id=a16deb6076942246","name":"postcss","version":"8.5.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-gm37-52c6-37mw","dataSource":"https://github.com/advisories/GHSA-gm37-52c6-37mw","namespace":"github:language:python","severity":"High","urls":["https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw","https://nvd.nist.gov/vuln/detail/CVE-2026-67422","https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b"],"description":"pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67422","epss":0.00608,"percentile":0.49086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67422","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.45599999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-67422","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67422","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b","https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw"],"description":"pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67422","epss":0.00608,"percentile":0.49086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67422","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pymdown-extensions","version":"10.21.3"}},"found":{"vulnerabilityID":"GHSA-gm37-52c6-37mw","versionConstraint":"<=11.0.0 (python)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:pypi/pymdown-extensions@10.21.3?package-id=e49182728fb47a8b","name":"pymdown-extensions","version":"10.21.3","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:facelessuser:pymdown_extensions:10.21.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pymdown-extensions@10.21.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-6h2x-m376-mqjq","dataSource":"https://github.com/advisories/GHSA-6h2x-m376-mqjq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq","https://github.com/hapijs/joi/pull/3143","https://github.com/hapijs/joi/pull/3145","https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec","https://github.com/hapijs/joi/commit/e70df424c367f2976db63b089504413744a21245","https://nvd.nist.gov/vuln/detail/CVE-2026-92599","https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate"],"description":"joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-92599","epss":0.00582,"percentile":0.47802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-92599","cwe":"CWE-1333","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["17.13.7"],"state":"fixed","available":[{"version":"17.13.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.45396},"relatedVulnerabilities":[{"id":"CVE-2026-92599","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92599","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq","https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate"],"description":"joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-92599","epss":0.00582,"percentile":0.47802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-92599","cwe":"CWE-1333","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.3"}},"found":{"vulnerabilityID":"GHSA-6h2x-m376-mqjq","versionConstraint":">=17.2.0,<17.13.7 (semantic)"},"fix":{"suggestedVersion":"17.13.7"}}],"artifact":{"id":"pkg:npm/joi@17.13.3?package-id=5542a1e63c4fcad6","name":"joi","version":"17.13.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:joi:joi:17.13.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-r7fv-28h4-cvq7","dataSource":"https://github.com/advisories/GHSA-r7fv-28h4-cvq7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7","https://nvd.nist.gov/vuln/detail/CVE-2026-111759","https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2"],"description":"markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111759","epss":0.00591,"percentile":0.48256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111759","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.2"],"state":"fixed","available":[{"version":"14.3.2","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.4432500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-111759","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111759","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"],"description":"markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111759","epss":0.00591,"percentile":0.48256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111759","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.1"}},"found":{"vulnerabilityID":"GHSA-r7fv-28h4-cvq7","versionConstraint":"<14.3.2 (semantic)"},"fix":{"suggestedVersion":"14.3.2"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.1?package-id=6b11c2f95d0a8dbc","name":"markdown-it","version":"14.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-g84c-rxfj-3j2c","dataSource":"https://github.com/advisories/GHSA-g84c-rxfj-3j2c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c","https://nvd.nist.gov/vuln/detail/CVE-2026-76844","https://github.com/webpack/webpack-dev-middleware/pull/2404","https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b","https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b","https://github.com/advisories/GHSA-wr3j-pwj9-hqq6","https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js","https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6","https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0","https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"],"description":"webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76844","epss":0.00592,"percentile":0.48318,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","source":"disclosure@vulncheck.com","type":"Primary"}],"fix":{"versions":["7.4.6"],"state":"fixed","available":[{"version":"7.4.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.44104},"relatedVulnerabilities":[{"id":"CVE-2026-76844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76844","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.","cvss":[{"source":"disclosure@vulncheck.com","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76844","epss":0.00592,"percentile":0.48318,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76844","cwe":"CWE-787","source":"disclosure@vulncheck.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-middleware","version":"5.3.4"}},"found":{"vulnerabilityID":"GHSA-g84c-rxfj-3j2c","versionConstraint":"<7.4.5 (semantic)"},"fix":{"suggestedVersion":"7.4.6"}}],"artifact":{"id":"pkg:npm/webpack-dev-middleware@5.3.4?package-id=59a99098fb3ad041","name":"webpack-dev-middleware","version":"5.3.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack-dev-middleware:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-middleware:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_middleware:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_middleware:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-middleware:5.3.4:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_middleware:5.3.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-middleware@5.3.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.0"],"state":"fixed","available":[{"version":"4.3.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=4.0.0,<4.3.0 (semantic)"},"fix":{"suggestedVersion":"4.3.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=15e5564f07e87e23","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7wch-p9px-956x","dataSource":"https://github.com/advisories/GHSA-7wch-p9px-956x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x","https://nvd.nist.gov/vuln/detail/CVE-2026-118779","https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Regular expression denial of service in PEM decoding (pem.decode)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.41700000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-118779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118779","epss":0.00556,"percentile":0.46406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118779","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-7wch-p9px-956x","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gfr2-rv44-r23c","dataSource":"https://github.com/advisories/GHSA-gfr2-rv44-r23c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c","https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"description":"markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111758","epss":0.0055,"percentile":0.46043,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111758","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111758","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.3"],"state":"fixed","available":[{"version":"14.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.41250000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-111758","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111758","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c"],"description":"markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111758","epss":0.0055,"percentile":0.46043,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111758","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111758","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.1"}},"found":{"vulnerabilityID":"GHSA-gfr2-rv44-r23c","versionConstraint":">=14.1.0,<14.3.3 (semantic)"},"fix":{"suggestedVersion":"14.3.3"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.1?package-id=6b11c2f95d0a8dbc","name":"markdown-it","version":"14.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w27v-7q3p-w38r","dataSource":"https://github.com/advisories/GHSA-w27v-7q3p-w38r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r","https://nvd.nist.gov/vuln/detail/CVE-2026-84370","https://github.com/svg/svgo/pull/2268","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0"],"description":"SVGO: removeScripts allows executable links through namespace and control-character bypasses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84370","epss":0.00525,"percentile":0.4452,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84370","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84370","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.4"],"state":"fixed","available":[{"version":"2.8.4","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.41212499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-84370","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84370","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/3db3ef33e409a0bc0fdaf255e46c908b00e93bc2","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/pull/2268","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0","https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r"],"description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84370","epss":0.00525,"percentile":0.4452,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84370","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84370","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"svgo","version":"2.8.2"}},"found":{"vulnerabilityID":"GHSA-w27v-7q3p-w38r","versionConstraint":">=1.0.0,<2.8.4 (semantic)"},"fix":{"suggestedVersion":"2.8.4"}}],"artifact":{"id":"pkg:npm/svgo@2.8.2?package-id=bd2e2b5c096be747","name":"svgo","version":"2.8.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:svgo:svgo:2.8.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/svgo@2.8.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=4.0.0,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=15e5564f07e87e23","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r825-w8mm-5pxw","dataSource":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw","https://nvd.nist.gov/vuln/detail/CVE-2026-112944","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.2"],"state":"fixed","available":[{"version":"2.14.2","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.398325},"relatedVulnerabilities":[{"id":"CVE-2026-112944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"launch-editor","version":"2.13.1"}},"found":{"vulnerabilityID":"GHSA-r825-w8mm-5pxw","versionConstraint":"<=2.14.1 (semantic)"},"fix":{"suggestedVersion":"2.14.2"}}],"artifact":{"id":"pkg:npm/launch-editor@2.13.1?package-id=3137ee48630ee5a8","name":"launch-editor","version":"2.13.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:launch-editor:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch-editor:launch_editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch_editor:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch_editor:launch_editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch:launch_editor:2.13.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/launch-editor@2.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r28c-9q8g-f849","dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.18"],"state":"fixed","available":[{"version":"8.5.18","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-73646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"7.0.39"}},"found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"fix":{"suggestedVersion":"8.5.18"}}],"artifact":{"id":"pkg:npm/postcss@7.0.39?package-id=6e0b8b643d46db35","name":"postcss","version":"7.0.39","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@7.0.39","upstreams":[]}},{"vulnerability":{"id":"GHSA-r28c-9q8g-f849","dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.18"],"state":"fixed","available":[{"version":"8.5.18","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-73646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.6"}},"found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"fix":{"suggestedVersion":"8.5.18"}}],"artifact":{"id":"pkg:npm/postcss@8.5.6?package-id=a16deb6076942246","name":"postcss","version":"8.5.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-37ch-88jc-xwx2","dataSource":"https://github.com/advisories/GHSA-37ch-88jc-xwx2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2","https://nvd.nist.gov/vuln/detail/CVE-2026-4867","https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13"],"description":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["0.1.13"],"state":"fixed","available":[{"version":"0.1.13","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.38625},"relatedVulnerabilities":[{"id":"CVE-2026-4867","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4867","namespace":"nvd:cpe","severity":"High","urls":["https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j"],"description":"Impact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\nCustom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.\n\nWorkarounds:\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.12"}},"found":{"vulnerabilityID":"GHSA-37ch-88jc-xwx2","versionConstraint":"<0.1.13 (semantic)"},"fix":{"suggestedVersion":"0.1.13"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.12?package-id=3bdfe6c6b1eaf09a","name":"path-to-regexp","version":"0.1.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111755","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=a8847fd98501e6bd","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects array-form headers bypass cross-origin credential stripping","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=a8847fd98501e6bd","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.12"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.12?package-id=300b7d6e5491c547","name":"brace-expansion","version":"1.1.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.6"],"state":"fixed","available":[{"version":"2.1.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=2.0.0,<2.1.6 (semantic)"},"fix":{"suggestedVersion":"2.1.6"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.2?package-id=f3c0dac3696b2b92","name":"brace-expansion","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-vc2v-76pw-4v95","dataSource":"https://github.com/advisories/GHSA-vc2v-76pw-4v95","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95","https://nvd.nist.gov/vuln/detail/CVE-2026-87776","https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/compression/releases/tag/v1.8.2"],"description":"compression vulnerable to Denial of Service via memory leak on premature response close","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87776","epss":0.00477,"percentile":0.41243,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87776","cwe":"CWE-401","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87776","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.8.2"],"state":"fixed","available":[{"version":"1.8.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35775},"relatedVulnerabilities":[{"id":"CVE-2026-87776","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87776","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95"],"description":"compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87776","epss":0.00477,"percentile":0.41243,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87776","cwe":"CWE-401","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87776","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"compression","version":"1.8.1"}},"found":{"vulnerabilityID":"GHSA-vc2v-76pw-4v95","versionConstraint":"<1.8.2 (semantic)"},"fix":{"suggestedVersion":"1.8.2"}}],"artifact":{"id":"pkg:npm/compression@1.8.1?package-id=321d5e5aadfc3016","name":"compression","version":"1.8.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:compression:compression:1.8.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/compression@1.8.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-68fv-2mgg-jv7q","dataSource":"https://github.com/advisories/GHSA-68fv-2mgg-jv7q","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93749","https://github.com/7rulnik/source-map-js/issues/76","https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service","https://github.com/7rulnik/source-map-js/pull/79","https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016","https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"],"description":"source-map-js allows event-loop denial of service through indexed source-map section offsets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.2.2"],"state":"fixed","available":[{"version":"1.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35490000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-93749","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://github.com/7rulnik/source-map-js/issues/76","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"],"description":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"source-map-js","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-68fv-2mgg-jv7q","versionConstraint":">=1.0.0,<1.2.2 (semantic)"},"fix":{"suggestedVersion":"1.2.2"}}],"artifact":{"id":"pkg:npm/source-map-js@1.2.1?package-id=ef14348a3e7aef73","name":"source-map-js","version":"1.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:source-map-js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map-js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source_map_js:1.2.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/source-map-js@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4528-x5fx-h6hg","dataSource":"https://github.com/advisories/GHSA-4528-x5fx-h6hg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg","https://nvd.nist.gov/vuln/detail/CVE-2026-118772","https://github.com/hapijs/joi/pull/3162","https://github.com/hapijs/joi/pull/3163","https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","https://github.com/hapijs/joi/releases/tag/v17.13.9","https://github.com/hapijs/joi/releases/tag/v18.3.1"],"description":"joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118772","epss":0.00467,"percentile":0.40465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118772","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["17.13.9"],"state":"fixed","available":[{"version":"17.13.9","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118772","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118772","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","https://github.com/hapijs/joi/pull/3162","https://github.com/hapijs/joi/pull/3163","https://github.com/hapijs/joi/releases/tag/v17.13.9","https://github.com/hapijs/joi/releases/tag/v18.3.1","https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"],"description":"joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118772","epss":0.00467,"percentile":0.40465,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118772","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.3"}},"found":{"vulnerabilityID":"GHSA-4528-x5fx-h6hg","versionConstraint":">=17.1.1,<17.13.9 (semantic)"},"fix":{"suggestedVersion":"17.13.9"}}],"artifact":{"id":"pkg:npm/joi@17.13.3?package-id=5542a1e63c4fcad6","name":"joi","version":"17.13.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:joi:joi:17.13.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-v245-v573-v5vm","dataSource":"https://github.com/advisories/GHSA-v245-v573-v5vm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm","https://nvd.nist.gov/vuln/detail/CVE-2026-59887","https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe","https://github.com/markdown-it/linkify-it/releases/tag/5.0.2"],"description":"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59887","epss":0.00467,"percentile":0.40435,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59887","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.2"],"state":"fixed","available":[{"version":"5.0.2","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-59887","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59887","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe","https://github.com/markdown-it/linkify-it/releases/tag/5.0.2","https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm"],"description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59887","epss":0.00467,"percentile":0.40435,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59887","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"linkify-it","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-v245-v573-v5vm","versionConstraint":"<=5.0.1 (semantic)"},"fix":{"suggestedVersion":"5.0.2"}}],"artifact":{"id":"pkg:npm/linkify-it@5.0.0?package-id=14452fa752ca31ab","name":"linkify-it","version":"5.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:linkify-it:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify-it:linkify_it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify_it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify_it:5.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/linkify-it@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-58qx-3vcg-4xpx","dataSource":"https://github.com/advisories/GHSA-58qx-3vcg-4xpx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://nvd.nist.gov/vuln/detail/CVE-2026-45736","https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"],"description":"ws: Uninitialized memory disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45736","epss":0.00745,"percentile":0.54803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45736","cwe":"CWE-908","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45736","cwe":"CWE-824","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.20.1"],"state":"fixed","available":[{"version":"8.20.1","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.35015},"relatedVulnerabilities":[{"id":"CVE-2026-45736","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://access.redhat.com/errata/RHSA-2026:26638","https://access.redhat.com/errata/RHSA-2026:26994","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/errata/RHSA-2026:7655","https://access.redhat.com/security/cve/CVE-2026-45736","https://bugzilla.redhat.com/show_bug.cgi?id=2477914","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json"],"description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45736","epss":0.00745,"percentile":0.54803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45736","cwe":"CWE-908","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45736","cwe":"CWE-824","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.19.0"}},"found":{"vulnerabilityID":"GHSA-58qx-3vcg-4xpx","versionConstraint":">=8.0.0,<8.20.1 (semantic)"},"fix":{"suggestedVersion":"8.20.1"}}],"artifact":{"id":"pkg:npm/ws@8.19.0?package-id=239cba1a77cea730","name":"ws","version":"8.19.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:8.19.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.19.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xv26-6w52-cph6","dataSource":"https://github.com/advisories/GHSA-xv26-6w52-cph6","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/faye/websocket-driver-node/security/advisories/GHSA-xv26-6w52-cph6","https://github.com/faye/websocket-driver-node/releases/tag/0.7.5"],"description":"websocket-driver: Message corruption via abuse of protocol length headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54466","epss":0.0038,"percentile":0.32008,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54466","cwe":"CWE-130","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.5"],"state":"fixed","available":[{"version":"0.7.5","date":"2026-07-16","kind":"first-observed"}]},"advisories":[],"risk":0.3458},"relatedVulnerabilities":[{"id":"CVE-2026-54466","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54466","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/faye/websocket-driver-node/commit/5b197ca874dab58e96cacad8a3c256797d804680","https://github.com/faye/websocket-driver-node/security/advisories/GHSA-xv26-6w52-cph6"],"description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54466","epss":0.0038,"percentile":0.32008,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54466","cwe":"CWE-130","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"websocket-driver","version":"0.7.4"}},"found":{"vulnerabilityID":"GHSA-xv26-6w52-cph6","versionConstraint":"<0.7.5 (semantic)"},"fix":{"suggestedVersion":"0.7.5"}}],"artifact":{"id":"pkg:npm/websocket-driver@0.7.4?package-id=944bd0667b1458ca","name":"websocket-driver","version":"0.7.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:websocket-driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket-driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket_driver:0.7.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/websocket-driver@0.7.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-2p49-hgcm-8545","dataSource":"https://github.com/advisories/GHSA-2p49-hgcm-8545","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545","https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466","https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f","https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763","https://github.com/svg/svgo/releases/tag/v2.8.3","https://github.com/svg/svgo/releases/tag/v3.3.4","https://github.com/svg/svgo/releases/tag/v4.0.2"],"description":"SVGO removeScripts plugin leaves some executable scripts intact","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73650","epss":0.00435,"percentile":0.37768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73650","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73650","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.3"],"state":"fixed","available":[{"version":"2.8.3","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.3414749999999999},"relatedVulnerabilities":[{"id":"CVE-2026-73650","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73650","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466","https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f","https://github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763","https://github.com/svg/svgo/releases/tag/v2.8.3","https://github.com/svg/svgo/releases/tag/v3.3.4","https://github.com/svg/svgo/releases/tag/v4.0.2","https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545"],"description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73650","epss":0.00435,"percentile":0.37768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73650","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73650","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"svgo","version":"2.8.2"}},"found":{"vulnerabilityID":"GHSA-2p49-hgcm-8545","versionConstraint":">=1.0.0,<2.8.3 (semantic)"},"fix":{"suggestedVersion":"2.8.3"}}],"artifact":{"id":"pkg:npm/svgo@2.8.2?package-id=bd2e2b5c096be747","name":"svgo","version":"2.8.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:svgo:svgo:2.8.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/svgo@2.8.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.12"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.12?package-id=300b7d6e5491c547","name":"brace-expansion","version":"1.1.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.5"],"state":"fixed","available":[{"version":"2.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=2.0.0,<2.1.5 (semantic)"},"fix":{"suggestedVersion":"2.1.5"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.2?package-id=f3c0dac3696b2b92","name":"brace-expansion","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-pqg4-j6r4-53mv","dataSource":"https://github.com/advisories/GHSA-pqg4-j6r4-53mv","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","https://nvd.nist.gov/vuln/detail/CVE-2026-102422","https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc"],"description":"shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102422","epss":0.00378,"percentile":0.31768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102422","cwe":"CWE-78","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["1.11.0"],"state":"fixed","available":[{"version":"1.11.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.33358499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-102422","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102422","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/ljharb/shell-quote","https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc","https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\\n, \\r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102422","epss":0.00378,"percentile":0.31768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102422","cwe":"CWE-78","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"shell-quote","version":"1.8.4"}},"found":{"vulnerabilityID":"GHSA-pqg4-j6r4-53mv","versionConstraint":">=1.8.4,<1.11.0 (semantic)"},"fix":{"suggestedVersion":"1.11.0"}}],"artifact":{"id":"pkg:npm/shell-quote@1.8.4?package-id=3aa2c5676001c76d","name":"shell-quote","version":"1.8.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:shell-quote_project:shell-quote:1.8.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/shell-quote@1.8.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-v2hh-gcrm-f6hx","dataSource":"https://github.com/advisories/GHSA-v2hh-gcrm-f6hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","https://nvd.nist.gov/vuln/detail/CVE-2026-16221","https://github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057","https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353","https://github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.3","https://github.com/fastify/fast-uri/releases/tag/v3.1.4","https://github.com/fastify/fast-uri/releases/tag/v4.1.1"],"description":"fast-uri vulnerable to host confusion via literal backslash authority delimiter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16221","epss":0.00436,"percentile":0.37868,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16221","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.327},"relatedVulnerabilities":[{"id":"CVE-2026-16221","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx"],"description":"Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. \n\nPatches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.\n\nWorkarounds: none.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16221","epss":0.00436,"percentile":0.37868,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16221","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-v2hh-gcrm-f6hx","versionConstraint":">=3.0.0,<=3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-22p9-wv53-3rq4","dataSource":"https://github.com/advisories/GHSA-22p9-wv53-3rq4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"],"description":"LinkifyIt#match scan loop has quadratic algorithmic complexity","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48801","epss":0.00394,"percentile":0.33576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48801","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-06-27","kind":"first-observed"}]},"advisories":[],"risk":0.31914},"relatedVulnerabilities":[{"id":"CVE-2026-48801","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"],"description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48801","epss":0.00394,"percentile":0.33576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48801","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"linkify-it","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-22p9-wv53-3rq4","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/linkify-it@5.0.0?package-id=14452fa752ca31ab","name":"linkify-it","version":"5.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:linkify-it:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify-it:linkify_it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify_it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify_it:5.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/linkify-it@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gjv8-xp57-g29c","dataSource":"https://github.com/advisories/GHSA-gjv8-xp57-g29c","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c","https://nvd.nist.gov/vuln/detail/CVE-2026-86000","https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef","https://github.com/facelessuser/soupsieve/releases/tag/2.9"],"description":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86000","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86000","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-86000","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["2.9.0"],"state":"fixed","available":[{"version":"2.9.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.313635},"relatedVulnerabilities":[{"id":"CVE-2026-86000","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86000","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef","https://github.com/facelessuser/soupsieve/releases/tag/2.9","https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c"],"description":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an attacker-controlled selector contains a long identifier or unquoted attribute-value run followed by input that makes the overall match fail, the regular expression engine explores quadratically many splits between the overlapping groups. User-controlled selectors can reach this path through soupsieve.compile(), soupsieve.select(), or BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. The resulting CPU consumption can hold the Python GIL, exhaust application workers, and stall a service; successful plain identifier matches are linear, and the issue does not cause memory corruption or code execution. The issue is fixed in version 2.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86000","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86000","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-86000","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"soupsieve","version":"2.8.3"}},"found":{"vulnerabilityID":"GHSA-gjv8-xp57-g29c","versionConstraint":"<2.9.0 (python)"},"fix":{"suggestedVersion":"2.9.0"}}],"artifact":{"id":"pkg:pypi/soupsieve@2.8.3?package-id=758817c0cb884687","name":"soupsieve","version":"2.8.3","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:soupsieve:2.8.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/soupsieve@2.8.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-j934-xhv5-fg8f","dataSource":"https://github.com/advisories/GHSA-j934-xhv5-fg8f","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f","https://nvd.nist.gov/vuln/detail/CVE-2026-85999","https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda","https://github.com/facelessuser/soupsieve/releases/tag/2.9"],"description":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85999","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85999","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85999","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.9.0"],"state":"fixed","available":[{"version":"2.9.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.313635},"relatedVulnerabilities":[{"id":"CVE-2026-85999","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85999","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda","https://github.com/facelessuser/soupsieve/releases/tag/2.9","https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f"],"description":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END, an end-anchored WSC whitespace-and-comment expression used with search(), so the regular expression engine retries a greedy scan at every starting offset. An attacker-controlled valid selector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The issue is fixed in version 2.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85999","epss":0.00609,"percentile":0.4917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85999","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85999","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"soupsieve","version":"2.8.3"}},"found":{"vulnerabilityID":"GHSA-j934-xhv5-fg8f","versionConstraint":"<2.9.0 (python)"},"fix":{"suggestedVersion":"2.9.0"}}],"artifact":{"id":"pkg:pypi/soupsieve@2.8.3?package-id=758817c0cb884687","name":"soupsieve","version":"2.8.3","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python-soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python_soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:soupsieve:soupsieve:2.8.3:*:*:*:*:*:*:*","cpe:2.3:a:python:soupsieve:2.8.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/soupsieve@2.8.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-hqq3-7jhf-c5jx","dataSource":"https://github.com/advisories/GHSA-hqq3-7jhf-c5jx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx","https://nvd.nist.gov/vuln/detail/CVE-2026-119187","https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via call stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31124999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-119187","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119187","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119187","epss":0.00415,"percentile":0.35807,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119187","cwe":"CWE-674","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-hqq3-7jhf-c5jx","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hrf-8g6f-7xwp","dataSource":"https://github.com/advisories/GHSA-8hrf-8g6f-7xwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp","https://nvd.nist.gov/vuln/detail/CVE-2026-119188","https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.30825},"relatedVulnerabilities":[{"id":"CVE-2026-119188","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119188","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119188","epss":0.00411,"percentile":0.35424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119188","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119188","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-8hrf-8g6f-7xwp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4v9v-hfq4-rm2v","dataSource":"https://github.com/advisories/GHSA-4v9v-hfq4-rm2v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v","https://nvd.nist.gov/vuln/detail/CVE-2025-30359","https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e","https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239"],"description":"webpack-dev-server users' source code may be stolen when they access a malicious web site","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30359","epss":0.00598,"percentile":0.48636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30359","cwe":"CWE-749","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.2.1"],"state":"fixed","available":[{"version":"5.2.1","date":"2025-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.30797},"relatedVulnerabilities":[{"id":"CVE-2025-30359","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30359","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v"],"description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code. Version 5.2.1 contains a patch for the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30359","epss":0.00598,"percentile":0.48636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30359","cwe":"CWE-749","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.15.2"}},"found":{"vulnerabilityID":"GHSA-4v9v-hfq4-rm2v","versionConstraint":"<=5.2.0 (semantic)"},"fix":{"suggestedVersion":"5.2.1"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.15.2?package-id=a36aabc20adb299f","name":"webpack-dev-server","version":"4.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.15.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-2wm5-q62r-hmrv","dataSource":"https://github.com/advisories/GHSA-2wm5-q62r-hmrv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv","https://nvd.nist.gov/vuln/detail/CVE-2026-85062","https://github.com/omgovich/colord/pull/141","https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2"],"description":"Colord: Slow rejection of oversized malformed color strings","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85062","epss":0.00507,"percentile":0.43266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85062","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.9.4"],"state":"fixed","available":[{"version":"2.9.4","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.30166499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-85062","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85062","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2","https://github.com/omgovich/colord/pull/141","https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv"],"description":"Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\\d*.?\\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85062","epss":0.00507,"percentile":0.43266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85062","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"colord","version":"2.9.3"}},"found":{"vulnerabilityID":"GHSA-2wm5-q62r-hmrv","versionConstraint":"<2.9.4 (semantic)"},"fix":{"suggestedVersion":"2.9.4"}}],"artifact":{"id":"pkg:npm/colord@2.9.3?package-id=115dfb6353bba246","name":"colord","version":"2.9.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:colord:colord:2.9.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/colord@2.9.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5vr-8v7q-w6rv","dataSource":"https://github.com/advisories/GHSA-w5vr-8v7q-w6rv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-45819","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","https://www.npmjs.com/package/baseline-browser-mapping","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137","https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589","https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0"],"description":"baseline-browser-mapping process termination on invalid input causes denial of service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45819","epss":0.00507,"percentile":0.43261,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45819","cwe":"CWE-705","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45819","cwe":"CWE-755","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.11.0"],"state":"fixed","available":[{"version":"2.11.0","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.29406},"relatedVulnerabilities":[{"id":"CVE-2026-45819","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","https://www.npmjs.com/package/baseline-browser-mapping"],"description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45819","epss":0.00507,"percentile":0.43261,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45819","cwe":"CWE-705","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45819","cwe":"CWE-755","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"baseline-browser-mapping","version":"2.10.0"}},"found":{"vulnerabilityID":"GHSA-w5vr-8v7q-w6rv","versionConstraint":">=2.0.0,<2.11.0 (semantic)"},"fix":{"suggestedVersion":"2.11.0"}}],"artifact":{"id":"pkg:npm/baseline-browser-mapping@2.10.0?package-id=25ec18dbd2e46bd0","name":"baseline-browser-mapping","version":"2.10.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:baseline-browser-mapping:baseline-browser-mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser-mapping:baseline_browser_mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser_mapping:baseline-browser-mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser_mapping:baseline_browser_mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser:baseline-browser-mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser:baseline_browser_mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser:baseline-browser-mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser:baseline_browser_mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline:baseline-browser-mapping:2.10.0:*:*:*:*:*:*:*","cpe:2.3:a:baseline:baseline_browser_mapping:2.10.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/baseline-browser-mapping@2.10.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.9"],"state":"fixed","available":[{"version":"1.20.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.5"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":"<1.20.9 (semantic)"},"fix":{"suggestedVersion":"1.20.9"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.5?package-id=04b33f5cfaf593a5","name":"body-parser","version":"1.20.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-7p8r-x3mc-p8w7","dataSource":"https://github.com/advisories/GHSA-7p8r-x3mc-p8w7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7","https://nvd.nist.gov/vuln/detail/CVE-2026-18446","https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v4.1.2"],"description":"fast-uri vulnerable to host confusion via backslash authority introducer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18446","epss":0.0038,"percentile":0.32009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18446","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.5"],"state":"fixed","available":[{"version":"3.1.5","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.28500000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-18446","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18446","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7"],"description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18446","epss":0.0038,"percentile":0.32009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18446","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7p8r-x3mc-p8w7","versionConstraint":">=3.0.0,<3.1.5 (semantic)"},"fix":{"suggestedVersion":"3.1.5"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-395f-4hp3-45gv","dataSource":"https://github.com/advisories/GHSA-395f-4hp3-45gv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv","https://nvd.nist.gov/vuln/detail/CVE-2026-13311","https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec","https://github.com/ljharb/shell-quote/releases/tag/v1.9.0","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13311","epss":0.0036,"percentile":0.29834,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13311","cwe":"CWE-407","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["1.9.0"],"state":"fixed","available":[{"version":"1.9.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.2808},"relatedVulnerabilities":[{"id":"CVE-2026-13311","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13311","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13311","epss":0.0036,"percentile":0.29834,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13311","cwe":"CWE-407","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"shell-quote","version":"1.8.4"}},"found":{"vulnerabilityID":"GHSA-395f-4hp3-45gv","versionConstraint":"<=1.8.4 (semantic)"},"fix":{"suggestedVersion":"1.9.0"}}],"artifact":{"id":"pkg:npm/shell-quote@1.8.4?package-id=3aa2c5676001c76d","name":"shell-quote","version":"1.8.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:shell-quote_project:shell-quote:1.8.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/shell-quote@1.8.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxq7-64xx-v4gw","dataSource":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.27470000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-97689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-vxq7-64xx-v4gw","versionConstraint":">=1.10.3,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f15e232a431c0539","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-x5fp-wj9c-mxmx","dataSource":"https://github.com/advisories/GHSA-x5fp-wj9c-mxmx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"],"description":"qs array-limit bypass via bracket-key comma parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.27},"relatedVulnerabilities":[{"id":"CVE-2026-82562","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"],"description":"### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.\n\n\n\n### Details\n\n\n\nIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require('qs');\n\n\n\nvar options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };\n\n\n\nqs.parse('a=1,2,3,4', options);   // RangeError: Array limit exceeded. Only 3 elements allowed in an array.\n\n\n\nqs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] }  (no throw)\n\n\n\nqs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });\n\n\n\n// no throw; a 1,000,001-element inner array is allocated\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.\n\n\n\n### Affected versions\n\n\n\n`>=6.14.2 <6.16.0`, fixed in v6.16.0.\n\n\n\nv6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.\n\n\n\n### Impact\n\n\n\nAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82562","epss":0.0054,"percentile":0.45457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82562","cwe":"CWE-770","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.2"}},"found":{"vulnerabilityID":"GHSA-x5fp-wj9c-mxmx","versionConstraint":">=6.14.2,<=6.15.3 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.15.2?package-id=d56e932955e0b9dd","name":"qs","version":"6.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-q7cg-457f-vx79","dataSource":"https://github.com/advisories/GHSA-q7cg-457f-vx79","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79","https://github.com/hapijs/joi/pull/3113","https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11"],"description":"joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48038","epss":0.00524,"percentile":0.44451,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48038","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["17.13.4"],"state":"fixed","available":[{"version":"17.13.4","date":"2026-06-13","kind":"first-observed"}]},"advisories":[],"risk":0.26986000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-48038","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48038","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74","https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7","https://github.com/hapijs/joi/pull/3113","https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79"],"description":"joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48038","epss":0.00524,"percentile":0.44451,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48038","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.3"}},"found":{"vulnerabilityID":"GHSA-q7cg-457f-vx79","versionConstraint":"<17.13.4 (semantic)"},"fix":{"suggestedVersion":"17.13.4"}}],"artifact":{"id":"pkg:npm/joi@17.13.3?package-id=5542a1e63c4fcad6","name":"joi","version":"17.13.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:joi:joi:17.13.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-qj8w-gfj5-8c6v","dataSource":"https://github.com/advisories/GHSA-qj8w-gfj5-8c6v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v","https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","https://nvd.nist.gov/vuln/detail/CVE-2026-34043","https://github.com/yahoo/serialize-javascript/releases/tag/v5.0.0"],"description":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34043","epss":0.00491,"percentile":0.42208,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34043","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34043","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.0.5"],"state":"fixed","available":[{"version":"7.0.5","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.267595},"relatedVulnerabilities":[{"id":"CVE-2026-34043","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34043","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v"],"description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34043","epss":0.00491,"percentile":0.42208,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34043","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34043","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-qj8w-gfj5-8c6v","versionConstraint":">=5.0.0,<7.0.5 (semantic)"},"fix":{"suggestedVersion":"7.0.5"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=c17a204c63311f3d","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-m28w-2pqf-7qgj","dataSource":"https://github.com/advisories/GHSA-m28w-2pqf-7qgj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj","https://nvd.nist.gov/vuln/detail/CVE-2026-14631","https://github.com/webpack/webpack-dev-server/pull/5699","https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f","https://cna.openjsf.org/security-advisories.html"],"description":"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14631","epss":0.00517,"percentile":0.43994,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14631","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-14631","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.2.6"],"state":"fixed","available":[{"version":"5.2.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.266255},"relatedVulnerabilities":[{"id":"CVE-2026-14631","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14631","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj"],"description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14631","epss":0.00517,"percentile":0.43994,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14631","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-14631","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.15.2"}},"found":{"vulnerabilityID":"GHSA-m28w-2pqf-7qgj","versionConstraint":"<=5.2.5 (semantic)"},"fix":{"suggestedVersion":"5.2.6"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.15.2?package-id=a36aabc20adb299f","name":"webpack-dev-server","version":"4.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.15.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.12"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.12?package-id=300b7d6e5491c547","name":"brace-expansion","version":"1.1.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.3"],"state":"fixed","available":[{"version":"2.0.3","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":">=2.0.0,<2.0.3 (semantic)"},"fix":{"suggestedVersion":"2.0.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.2?package-id=f3c0dac3696b2b92","name":"brace-expansion","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.23"],"state":"fixed","available":[{"version":"8.5.23","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.254815},"relatedVulnerabilities":[{"id":"CVE-2026-69153","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"7.0.39"}},"found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"fix":{"suggestedVersion":"8.5.23"}}],"artifact":{"id":"pkg:npm/postcss@7.0.39?package-id=6e0b8b643d46db35","name":"postcss","version":"7.0.39","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@7.0.39","upstreams":[]}},{"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.23"],"state":"fixed","available":[{"version":"8.5.23","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.254815},"relatedVulnerabilities":[{"id":"CVE-2026-69153","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.6"}},"found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"fix":{"suggestedVersion":"8.5.23"}}],"artifact":{"id":"pkg:npm/postcss@8.5.6?package-id=a16deb6076942246","name":"postcss","version":"8.5.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.12"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.12?package-id=300b7d6e5491c547","name":"brace-expansion","version":"1.1.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.2"],"state":"fixed","available":[{"version":"2.1.2","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":">=2.0.0,<2.1.2 (semantic)"},"fix":{"suggestedVersion":"2.1.2"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.2?package-id=f3c0dac3696b2b92","name":"brace-expansion","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5vj-f2hx-8m93","dataSource":"https://github.com/advisories/GHSA-f5vj-f2hx-8m93","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93","https://nvd.nist.gov/vuln/detail/CVE-2026-14620","https://github.com/webpack/webpack-dev-server/pull/5698","https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c","https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6"],"description":"webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14620","epss":0.00521,"percentile":0.44259,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14620","cwe":"CWE-352","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-14620","cwe":"CWE-749","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.2.6"],"state":"fixed","available":[{"version":"5.2.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.252685},"relatedVulnerabilities":[{"id":"CVE-2026-14620","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14620","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93"],"description":"webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14620","epss":0.00521,"percentile":0.44259,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14620","cwe":"CWE-352","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-14620","cwe":"CWE-749","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.15.2"}},"found":{"vulnerabilityID":"GHSA-f5vj-f2hx-8m93","versionConstraint":"<=5.2.5 (semantic)"},"fix":{"suggestedVersion":"5.2.6"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.15.2?package-id=a36aabc20adb299f","name":"webpack-dev-server","version":"4.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.15.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-mp7j-qc5w-4988","dataSource":"https://github.com/advisories/GHSA-mp7j-qc5w-4988","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988","https://github.com/faye/websocket-driver-node/releases/tag/0.7.5"],"description":"websocket-driver: Resource limit bypass via message compression","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54490","epss":0.00445,"percentile":0.38693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54490","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.5"],"state":"fixed","available":[{"version":"0.7.5","date":"2026-07-16","kind":"first-observed"}]},"advisories":[],"risk":0.25142499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-54490","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54490","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f","https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988"],"description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54490","epss":0.00445,"percentile":0.38693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54490","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"websocket-driver","version":"0.7.4"}},"found":{"vulnerabilityID":"GHSA-mp7j-qc5w-4988","versionConstraint":"<0.7.5 (semantic)"},"fix":{"suggestedVersion":"0.7.5"}}],"artifact":{"id":"pkg:npm/websocket-driver@0.7.4?package-id=944bd0667b1458ca","name":"websocket-driver","version":"0.7.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:websocket-driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket-driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket_driver:0.7.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/websocket-driver@0.7.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v37-7h3g-55p8","dataSource":"https://github.com/advisories/GHSA-2v37-7h3g-55p8","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67213","https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom","https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b","https://github.com/ai/nanoid/releases/tag/3.3.17","https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0","https://github.com/ai/nanoid/releases/tag/3.3.18"],"description":"nanoid: custom generators can loop indefinitely when size is zero","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.18"],"state":"fixed","available":[{"version":"3.3.18","date":"2026-08-13","kind":"first-observed"}]},"advisories":[],"risk":0.24080250000000003},"relatedVulnerabilities":[{"id":"CVE-2026-67213","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67213","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom"],"description":"nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-2v37-7h3g-55p8","versionConstraint":"<3.3.18 (semantic)"},"fix":{"suggestedVersion":"3.3.18"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=fc2d97a12d1a4dda","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-28wg-ghj8-5hjv","dataSource":"https://github.com/advisories/GHSA-28wg-ghj8-5hjv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67214","https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","https://github.com/ai/nanoid/pull/600","https://github.com/ai/nanoid/pull/601","https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d"],"description":"nanoid: non-secure generators can loop indefinitely with negative size","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.16"],"state":"fixed","available":[{"version":"3.3.16","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.240075},"relatedVulnerabilities":[{"id":"CVE-2026-67214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/3.3.16","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"],"description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-28wg-ghj8-5hjv","versionConstraint":"<3.3.16 (semantic)"},"fix":{"suggestedVersion":"3.3.16"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=fc2d97a12d1a4dda","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-4vpr-x523-8j87","dataSource":"https://github.com/advisories/GHSA-4vpr-x523-8j87","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87","https://nvd.nist.gov/vuln/detail/CVE-2026-84369","https://github.com/svg/svgo/pull/2264","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0"],"description":"SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84369","epss":0.0043,"percentile":0.3723,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84369","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.4"],"state":"fixed","available":[{"version":"2.8.4","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.23864999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-84369","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84369","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/svg/svgo/commit/0557385564a5c6c11d76cd934a6cff94451e532c","https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f","https://github.com/svg/svgo/commit/fd51e474a300417d9361d9302d596b1763146327","https://github.com/svg/svgo/pull/2264","https://github.com/svg/svgo/pull/2269","https://github.com/svg/svgo/pull/2272","https://github.com/svg/svgo/releases/tag/v2.8.4","https://github.com/svg/svgo/releases/tag/v3.3.5","https://github.com/svg/svgo/releases/tag/v4.1.0","https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87"],"description":"SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84369","epss":0.0043,"percentile":0.3723,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84369","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"svgo","version":"2.8.2"}},"found":{"vulnerabilityID":"GHSA-4vpr-x523-8j87","versionConstraint":">=1.0.0,<2.8.4 (semantic)"},"fix":{"suggestedVersion":"2.8.4"}}],"artifact":{"id":"pkg:npm/svgo@2.8.2?package-id=bd2e2b5c096be747","name":"svgo","version":"2.8.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:svgo:svgo:2.8.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/svgo@2.8.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqcg-44mw-7w3h","dataSource":"https://github.com/advisories/GHSA-jqcg-44mw-7w3h","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"description":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.8"],"state":"fixed","available":[{"version":"2.0.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.2353},"relatedVulnerabilities":[{"id":"CVE-2026-90711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"],"description":"proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"proxy-addr","version":"2.0.7"}},"found":{"vulnerabilityID":"GHSA-jqcg-44mw-7w3h","versionConstraint":">=1.1.0,<2.0.8 (semantic)"},"fix":{"suggestedVersion":"2.0.8"}}],"artifact":{"id":"pkg:npm/proxy-addr@2.0.7?package-id=ce10aea6db36304a","name":"proxy-addr","version":"2.0.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:proxy-addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy-addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy_addr:2.0.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/proxy-addr@2.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-698v-4r3x-3vcv","dataSource":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://nvd.nist.gov/vuln/detail/CVE-2026-112943","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: escapeCmdArgs() omits % escaping on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.2"],"state":"fixed","available":[{"version":"2.14.2","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.23390999999999992},"relatedVulnerabilities":[{"id":"CVE-2026-112943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"launch-editor","version":"2.13.1"}},"found":{"vulnerabilityID":"GHSA-698v-4r3x-3vcv","versionConstraint":"<=2.14.1 (semantic)"},"fix":{"suggestedVersion":"2.14.2"}}],"artifact":{"id":"pkg:npm/launch-editor@2.13.1?package-id=3137ee48630ee5a8","name":"launch-editor","version":"2.13.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:launch-editor:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch-editor:launch_editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch_editor:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch_editor:launch_editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch:launch_editor:2.13.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/launch-editor@2.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-64mm-vxmg-q3vj","dataSource":"https://github.com/advisories/GHSA-64mm-vxmg-q3vj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj"],"description":"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-55602","epss":0.00378,"percentile":0.3176,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-55602","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-55602","cwe":"CWE-187","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.10"],"state":"fixed","available":[{"version":"2.0.10","date":"2026-06-22","kind":"first-observed"}]},"advisories":[],"risk":0.22491},"relatedVulnerabilities":[{"id":"CVE-2026-55602","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55602","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj"],"description":"http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-55602","epss":0.00378,"percentile":0.3176,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-55602","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-55602","cwe":"CWE-187","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"http-proxy-middleware","version":"2.0.9"}},"found":{"vulnerabilityID":"GHSA-64mm-vxmg-q3vj","versionConstraint":">=0.16.0,<2.0.10 (semantic)"},"fix":{"suggestedVersion":"2.0.10"}}],"artifact":{"id":"pkg:npm/http-proxy-middleware@2.0.9?package-id=285999c3fbfc8975","name":"http-proxy-middleware","version":"2.0.9","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:chimurai:http-proxy-middleware:2.0.9:*:*:*:*:*:*:*"],"purl":"pkg:npm/http-proxy-middleware@2.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwg4-73v4-xw9w","dataSource":"https://github.com/advisories/GHSA-xwg4-73v4-xw9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","https://nvd.nist.gov/vuln/detail/CVE-2026-73086","https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11"],"description":"nanoid: Integer Overflow or Wraparound","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.3.12"],"state":"fixed","available":[{"version":"3.3.12","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.22052},"relatedVulnerabilities":[{"id":"CVE-2026-73086","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11","https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"],"description":"nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.11"}},"found":{"vulnerabilityID":"GHSA-xwg4-73v4-xw9w","versionConstraint":"<3.3.12 (semantic)"},"fix":{"suggestedVersion":"3.3.12"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.11?package-id=fc2d97a12d1a4dda","name":"nanoid","version":"3.3.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.12"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.12?package-id=300b7d6e5491c547","name":"brace-expansion","version":"1.1.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.7"],"state":"fixed","available":[{"version":"2.1.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=2.0.0,<2.1.7 (semantic)"},"fix":{"suggestedVersion":"2.1.7"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.2?package-id=f3c0dac3696b2b92","name":"brace-expansion","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-g6cj-pr64-35w5","dataSource":"https://github.com/advisories/GHSA-g6cj-pr64-35w5","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5","https://github.com/pyca/cryptography/pull/15369","https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"],"description":"cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69247","epss":0.00274,"percentile":0.19875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69247","cwe":"CWE-208","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69247","cwe":"CWE-209","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["50.0.0"],"state":"fixed","available":[{"version":"50.0.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.21508999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-69247","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69247","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f","https://github.com/pyca/cryptography/pull/15369","https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5"],"description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69247","epss":0.00274,"percentile":0.19875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69247","cwe":"CWE-208","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69247","cwe":"CWE-209","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"cryptography","version":"48.0.0"}},"found":{"vulnerabilityID":"GHSA-g6cj-pr64-35w5","versionConstraint":">=44.0.0,<50.0.0 (python)"},"fix":{"suggestedVersion":"50.0.0"}}],"artifact":{"id":"pkg:pypi/cryptography@48.0.0?package-id=5deb53d1c2bc98e4","name":"cryptography","version":"48.0.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:cryptography.io:cryptography:48.0.0:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:48.0.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/cryptography@48.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6wh-96g9-6wx3","dataSource":"https://github.com/advisories/GHSA-v6wh-96g9-6wx3","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3"],"description":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53632","epss":0.00408,"percentile":0.35134,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53632","cwe":"CWE-73","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53632","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.14.1"],"state":"fixed","available":[{"version":"2.14.1","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21420000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53632","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53632","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53632","epss":0.00408,"percentile":0.35134,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53632","cwe":"CWE-73","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53632","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"launch-editor","version":"2.13.1"}},"found":{"vulnerabilityID":"GHSA-v6wh-96g9-6wx3","versionConstraint":"<=2.14.0 (semantic)"},"fix":{"suggestedVersion":"2.14.1"}}],"artifact":{"id":"pkg:npm/launch-editor@2.13.1?package-id=3137ee48630ee5a8","name":"launch-editor","version":"2.13.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:launch-editor:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch-editor:launch_editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch_editor:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch_editor:launch_editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch:launch-editor:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:launch:launch_editor:2.13.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/launch-editor@2.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.2"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.15.2?package-id=d56e932955e0b9dd","name":"qs","version":"6.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":">=4.0.0,<=4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=15e5564f07e87e23","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-jwv3-5hgf-82ww","dataSource":"https://github.com/advisories/GHSA-jwv3-5hgf-82ww","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww","https://github.com/pyca/cryptography/pull/14960","https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582","https://nvd.nist.gov/vuln/detail/CVE-2026-69249","https://github.com/pyca/cryptography/commit/3763aa79b","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml"],"description":"python-cryptography: Duplicate self-signed intermediates can cause exponential path-building","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69249","epss":0.00262,"percentile":0.18004,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69249","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["49.0.0"],"state":"fixed","available":[{"version":"49.0.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.21222},"relatedVulnerabilities":[{"id":"CVE-2026-69249","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyca/cryptography/commit/3763aa79b","https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582","https://github.com/pyca/cryptography/pull/14960","https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml"],"description":"python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69249","epss":0.00262,"percentile":0.18004,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69249","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"cryptography","version":"48.0.0"}},"found":{"vulnerabilityID":"GHSA-jwv3-5hgf-82ww","versionConstraint":">=42.0.0,<49.0.0 (python)"},"fix":{"suggestedVersion":"49.0.0"}}],"artifact":{"id":"pkg:pypi/cryptography@48.0.0?package-id=5deb53d1c2bc98e4","name":"cryptography","version":"48.0.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:cryptography.io:cryptography:48.0.0:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:48.0.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/cryptography@48.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/pull/346","https://github.com/postcss/postcss-selector-parser/commit/70b0779c843462197380d25daa02d1528bf7eae5","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5"],"description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.1.5"],"state":"fixed","available":[{"version":"6.1.5","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0.212005},"relatedVulnerabilities":[{"id":"CVE-2026-104844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"6.1.2"}},"found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<6.1.5 (semantic)"},"fix":{"suggestedVersion":"6.1.5"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@6.1.2?package-id=f7f4c134629f3b3a","name":"postcss-selector-parser","version":"6.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@6.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/pull/346","https://github.com/postcss/postcss-selector-parser/commit/70b0779c843462197380d25daa02d1528bf7eae5","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5"],"description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.1.6"],"state":"fixed","available":[{"version":"7.1.6","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.212005},"relatedVulnerabilities":[{"id":"CVE-2026-104844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"7.1.1"}},"found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":">=7.0.0,<7.1.6 (semantic)"},"fix":{"suggestedVersion":"7.1.6"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@7.1.1?package-id=90e1be19281fde27","name":"postcss-selector-parser","version":"7.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@7.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-g6x2-hccm-hh4m","dataSource":"https://github.com/advisories/GHSA-g6x2-hccm-hh4m","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m","https://nvd.nist.gov/vuln/detail/CVE-2026-102598","https://github.com/pallets/werkzeug/pull/3309","https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6","https://github.com/pallets/werkzeug/releases/tag/3.1.9"],"description":"Werkzeug safe_join() allows Windows special device names","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102598","epss":0.0037,"percentile":0.3092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102598","cwe":"CWE-67","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.20904999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-102598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102598","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6","https://github.com/pallets/werkzeug/pull/3309","https://github.com/pallets/werkzeug/releases/tag/3.1.9","https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m"],"description":"Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102598","epss":0.0037,"percentile":0.3092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102598","cwe":"CWE-67","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"werkzeug","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-g6x2-hccm-hh4m","versionConstraint":"<3.1.9 (python)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:pypi/werkzeug@3.1.8?package-id=51fc83403330430a","name":"werkzeug","version":"3.1.8","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-werkzeug:python-werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python-werkzeug:python_werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:python-werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:python_werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python-werkzeug:werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:python-werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:python_werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python-werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python_werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python:werkzeug:3.1.8:*:*:*:*:*:*:*"],"purl":"pkg:pypi/werkzeug@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@8.3.2?package-id=8cf0c19ede45d1bc","name":"uuid","version":"8.3.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:uuidjs:uuid:8.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-9xwg-3r6f-jcx2","dataSource":"https://github.com/advisories/GHSA-9xwg-3r6f-jcx2","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2","https://github.com/facelessuser/pymdown-extensions/commit/edce35586d11a1ef78bb187bc60497fe6dbf3b64","https://github.com/facelessuser/pymdown-extensions/releases/tag/11.0"],"description":"PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61632","epss":0.00403,"percentile":0.34581,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61632","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.0"],"state":"fixed","available":[{"version":"11.0.0","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.207545},"relatedVulnerabilities":[{"id":"CVE-2026-61632","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61632","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/facelessuser/pymdown-extensions/releases/tag/11.0","https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2"],"description":"PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by <img src=\"...\"> by joining the src onto the configured base_path with os.path.normpath and opening the result directly, without verifying that the resolved path stays inside base_path. As a result, an src containing ../ sequences or an absolute path reads a file outside base_path as long as it has an allowed image extension (.png, .jpg, .jpeg, .gif, .svg), and the file's contents are then base64-encoded into the rendered output, disclosing them. An application that renders untrusted Markdown with pymdownx.b64 enabled can therefore leak the contents of image-extension files readable by the process to whoever controls the Markdown or views the output, a targeted file-read bounded by the extension check. This issue has been fixed in version 11.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61632","epss":0.00403,"percentile":0.34581,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61632","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pymdown-extensions","version":"10.21.3"}},"found":{"vulnerabilityID":"GHSA-9xwg-3r6f-jcx2","versionConstraint":"<=10.21.3 (python)"},"fix":{"suggestedVersion":"11.0.0"}}],"artifact":{"id":"pkg:pypi/pymdown-extensions@10.21.3?package-id=e49182728fb47a8b","name":"pymdown-extensions","version":"10.21.3","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:facelessuser:pymdown_extensions:10.21.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pymdown-extensions@10.21.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-9jgg-88mc-972h","dataSource":"https://github.com/advisories/GHSA-9jgg-88mc-972h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h","https://nvd.nist.gov/vuln/detail/CVE-2025-30360","https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb","https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239","https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127","https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e"],"description":"webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30360","epss":0.00357,"percentile":0.29481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30360","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.2.1"],"state":"fixed","available":[{"version":"5.2.1","date":"2025-06-05","kind":"first-observed"}]},"advisories":[],"risk":0.20527499999999999},"relatedVulnerabilities":[{"id":"CVE-2025-30360","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30360","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127","https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e","https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h"],"description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-30360","epss":0.00357,"percentile":0.29481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30360","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.15.2"}},"found":{"vulnerabilityID":"GHSA-9jgg-88mc-972h","versionConstraint":"<=5.2.0 (semantic)"},"fix":{"suggestedVersion":"5.2.1"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.15.2?package-id=a36aabc20adb299f","name":"webpack-dev-server","version":"4.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.15.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.15.2"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.15.2?package-id=d56e932955e0b9dd","name":"qs","version":"6.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.15.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.5.0"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@10.5.0?package-id=8da722cb9983d6b3","name":"glob","version":"10.5.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6v5v-wf23-fmfq","dataSource":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"description":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48988","epss":0.00379,"percentile":0.31865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.2.0"],"state":"fixed","available":[{"version":"14.2.0","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.195185},"relatedVulnerabilities":[{"id":"CVE-2026-48988","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48988","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48988","epss":0.00379,"percentile":0.31865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.1"}},"found":{"vulnerabilityID":"GHSA-6v5v-wf23-fmfq","versionConstraint":"<=14.1.1 (semantic)"},"fix":{"suggestedVersion":"14.2.0"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.1?package-id=6b11c2f95d0a8dbc","name":"markdown-it","version":"14.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-wr44-6hxh-3jwq","dataSource":"https://github.com/advisories/GHSA-wr44-6hxh-3jwq","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-90771","https://github.com/hapijs/joi/issues/3150","https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","https://github.com/hapijs/joi","https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages","https://github.com/hapijs/joi/pull/3151","https://github.com/hapijs/joi/pull/3153","https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2","https://github.com/hapijs/joi/releases/tag/v17.13.8","https://github.com/hapijs/joi/releases/tag/v18.2.9"],"description":"joi messages compilation allows prototype replacement through __proto__ error codes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90771","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90771","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["17.13.8"],"state":"fixed","available":[{"version":"17.13.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.19449999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-90771","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90771","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/hapijs/joi","https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","https://github.com/hapijs/joi/issues/3150","https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"],"description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90771","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90771","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.3"}},"found":{"vulnerabilityID":"GHSA-wr44-6hxh-3jwq","versionConstraint":"<17.13.8 (semantic)"},"fix":{"suggestedVersion":"17.13.8"}}],"artifact":{"id":"pkg:npm/joi@17.13.3?package-id=5542a1e63c4fcad6","name":"joi","version":"17.13.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:joi:joi:17.13.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrwp-f3q8-3g9p","dataSource":"https://github.com/advisories/GHSA-mrwp-f3q8-3g9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p","https://nvd.nist.gov/vuln/detail/CVE-2026-116689","https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"],"description":"follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.2"],"state":"fixed","available":[{"version":"1.16.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.193515},"relatedVulnerabilities":[{"id":"CVE-2026-116689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-mrwp-f3q8-3g9p","versionConstraint":">=1.16.0,<=1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.2"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=a8847fd98501e6bd","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-86w9-cpqp-85rv","dataSource":"https://github.com/advisories/GHSA-86w9-cpqp-85rv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding","https://github.com/digitalbazaar/forge/pull/1152"],"description":"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.19344},"relatedVulnerabilities":[{"id":"CVE-2026-85393","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85393","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://github.com/digitalbazaar/forge/issues/1149","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding"],"description":"node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85393","epss":0.00248,"percentile":0.16158,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85393","cwe":"CWE-347","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-86w9-cpqp-85rv","versionConstraint":"<=1.4.0 (semantic)"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5x38-2vff-x55p","dataSource":"https://github.com/advisories/GHSA-5x38-2vff-x55p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p","https://nvd.nist.gov/vuln/detail/CVE-2026-119190","https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.18327000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-119190","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119190","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119190","epss":0.00246,"percentile":0.15897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119190","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119190","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5x38-2vff-x55p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qw65-cvwx-89v3","dataSource":"https://github.com/advisories/GHSA-qw65-cvwx-89v3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","https://nvd.nist.gov/vuln/detail/CVE-2026-84292","https://github.com/fastify/fast-uri/commit/820e8478dd7da3d09f187bfaf35d50b71f67b8b4","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.6","https://github.com/fastify/fast-uri/releases/tag/v3.1.7","https://github.com/fastify/fast-uri/releases/tag/v4.1.4"],"description":"fast-uri vulnerable to authority injection via an unvalidated port in serialize","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.7"],"state":"fixed","available":[{"version":"3.1.7","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.17925000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-84292","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"],"description":"fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-qw65-cvwx-89v3","versionConstraint":">=3.0.0,<3.1.7 (semantic)"},"fix":{"suggestedVersion":"3.1.7"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.0.3"],"state":"fixed","available":[{"version":"8.0.3","date":"2026-01-15","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"7.0.0"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=6.0.0,<8.0.3 (semantic)"},"fix":{"suggestedVersion":"8.0.3"}}],"artifact":{"id":"pkg:npm/diff@7.0.0?package-id=c4f111820df6ef73","name":"diff","version":"7.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:kpdecker:jsdiff:7.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@7.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqff-g426-hqxp","dataSource":"https://github.com/advisories/GHSA-jqff-g426-hqxp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","https://nvd.nist.gov/vuln/detail/CVE-2026-76172","https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862","https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b","https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76172","epss":0.00232,"percentile":0.14137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76172","cwe":"CWE-177","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.174},"relatedVulnerabilities":[{"id":"CVE-2026-76172","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"],"description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76172","epss":0.00232,"percentile":0.14137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76172","cwe":"CWE-177","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-jqff-g426-hqxp","versionConstraint":">=3.0.0,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-gh4c-6fx4-qh6g","dataSource":"https://github.com/advisories/GHSA-gh4c-6fx4-qh6g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: Chunked Deflate streaming can enter an infinite loop","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97688","epss":0.00292,"percentile":0.21778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-97688","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"],"description":"urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97688","epss":0.00292,"percentile":0.21778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-gh4c-6fx4-qh6g","versionConstraint":">=2.6.2,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f15e232a431c0539","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.5?package-id=9514b69da6a9a890","name":"minimatch","version":"3.1.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.9"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.9?package-id=dadb042585b0fc99","name":"minimatch","version":"9.0.9","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvg9-69gf-fjrf","dataSource":"https://github.com/advisories/GHSA-xvg9-69gf-fjrf","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf","https://nvd.nist.gov/vuln/detail/CVE-2026-73295","https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25","https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7"],"description":"Material for MkDocs: DOM XSS in search suggestions via query parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73295","epss":0.00327,"percentile":0.25811,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73295","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.7.7"],"state":"fixed","available":[{"version":"9.7.7","date":"2026-09-04","kind":"first-observed"}]},"advisories":[],"risk":0.17004},"relatedVulnerabilities":[{"id":"CVE-2026-73295","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73295","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25","https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7","https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf"],"description":"Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73295","epss":0.00327,"percentile":0.25811,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73295","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"mkdocs-material","version":"9.7.6"}},"found":{"vulnerabilityID":"GHSA-xvg9-69gf-fjrf","versionConstraint":">=7.2.0,<9.7.7 (python)"},"fix":{"suggestedVersion":"9.7.7"}}],"artifact":{"id":"pkg:pypi/mkdocs-material@9.7.6?package-id=e4edf05232ff63ab","name":"mkdocs-material","version":"9.7.6","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-mkdocs-material:python-mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python-mkdocs-material:python_mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python_mkdocs_material:python-mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python_mkdocs_material:python_mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs-material:python-mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs-material:python_mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs_material:python-mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs_material:python_mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python-mkdocs-material:mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python-mkdocs-material:mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python_mkdocs_material:mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python_mkdocs_material:mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python-mkdocs:python-mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python-mkdocs:python_mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python_mkdocs:python-mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python_mkdocs:python_mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs-material:mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs-material:mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs_material:mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs_material:mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs:python-mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs:python_mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python-mkdocs:mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python-mkdocs:mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python-mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python:python_mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python_mkdocs:mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python_mkdocs:mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs:mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:mkdocs:mkdocs_material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python:mkdocs-material:9.7.6:*:*:*:*:*:*:*","cpe:2.3:a:python:mkdocs_material:9.7.6:*:*:*:*:*:*:*"],"purl":"pkg:pypi/mkdocs-material@9.7.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-f65p-4m7j-42xc","dataSource":"https://github.com/advisories/GHSA-f65p-4m7j-42xc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","https://nvd.nist.gov/vuln/detail/CVE-2026-75975","https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595","https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f","https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75975","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75975","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75975","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.165},"relatedVulnerabilities":[{"id":"CVE-2026-75975","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc"],"description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75975","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75975","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75975","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-f65p-4m7j-42xc","versionConstraint":">=3.0.0,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-fph4-wmhf-6fwf","dataSource":"https://github.com/advisories/GHSA-fph4-wmhf-6fwf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf","https://nvd.nist.gov/vuln/detail/CVE-2026-75899","https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f","https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304","https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75899","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75899","cwe":"CWE-174","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75899","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.165},"relatedVulnerabilities":[{"id":"CVE-2026-75899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75899","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"],"description":"fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75899","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75899","cwe":"CWE-174","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75899","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-fph4-wmhf-6fwf","versionConstraint":">=3.1.2,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-9cw3-xx77","dataSource":"https://github.com/advisories/GHSA-8988-9cw3-xx77","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.15553},"relatedVulnerabilities":[{"id":"CVE-2026-97687","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.7.0"}},"found":{"vulnerabilityID":"GHSA-8988-9cw3-xx77","versionConstraint":">=1.26.0,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.7.0?package-id=f15e232a431c0539","name":"urllib3","version":"2.7.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-79cf-xcqc-c78w","dataSource":"https://github.com/advisories/GHSA-79cf-xcqc-c78w","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h","https://nvd.nist.gov/vuln/detail/CVE-2026-6402","https://cna.openjsf.org/security-advisories.html"],"description":"webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6402","epss":0.00291,"percentile":0.21732,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6402","cwe":"CWE-749","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.2.4"],"state":"fixed","available":[{"version":"5.2.4","date":"2026-05-18","kind":"first-observed"}]},"advisories":[],"risk":0.149865},"relatedVulnerabilities":[{"id":"CVE-2026-6402","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6402","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w"],"description":"webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6402","epss":0.00291,"percentile":0.21732,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6402","cwe":"CWE-749","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.15.2"}},"found":{"vulnerabilityID":"GHSA-79cf-xcqc-c78w","versionConstraint":"<=5.2.3 (semantic)"},"fix":{"suggestedVersion":"5.2.4"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.15.2?package-id=a36aabc20adb299f","name":"webpack-dev-server","version":"4.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.15.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-m2h6-j472-rp4c","dataSource":"https://github.com/advisories/GHSA-m2h6-j472-rp4c","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c","https://github.com/pyca/cryptography/pull/14888","https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2","https://nvd.nist.gov/vuln/detail/CVE-2026-69248","https://github.com/pyca/cryptography/commit/286c89128","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3554.yaml"],"description":"python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69248","epss":0.00244,"percentile":0.1562,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69248","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["49.0.0"],"state":"fixed","available":[{"version":"49.0.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.14517999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-69248","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69248","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2","https://github.com/pyca/cryptography/pull/14888","https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c"],"description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69248","epss":0.00244,"percentile":0.1562,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69248","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"cryptography","version":"48.0.0"}},"found":{"vulnerabilityID":"GHSA-m2h6-j472-rp4c","versionConstraint":">=45.0.0,<49.0.0 (python)"},"fix":{"suggestedVersion":"49.0.0"}}],"artifact":{"id":"pkg:pypi/cryptography@48.0.0?package-id=5deb53d1c2bc98e4","name":"cryptography","version":"48.0.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:cryptography.io:cryptography:48.0.0:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:48.0.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/cryptography@48.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vfgh-jcmw-g37q","dataSource":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://nvd.nist.gov/vuln/detail/CVE-2026-111766","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"description":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111766","epss":0.00428,"percentile":0.37065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111766","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.3"],"state":"fixed","available":[{"version":"14.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.14337999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-111766","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111766","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"],"description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111766","epss":0.00428,"percentile":0.37065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111766","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.1"}},"found":{"vulnerabilityID":"GHSA-vfgh-jcmw-g37q","versionConstraint":"<14.3.3 (semantic)"},"fix":{"suggestedVersion":"14.3.3"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.1?package-id=6b11c2f95d0a8dbc","name":"markdown-it","version":"14.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-110306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-v4x8-3wr5-3wq8","dataSource":"https://github.com/advisories/GHSA-v4x8-3wr5-3wq8","namespace":"github:language:python","severity":"High","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8","https://nvd.nist.gov/vuln/detail/CVE-2026-112940","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112940","epss":0.0019,"percentile":0.08751,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112940","cwe":"CWE-363","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112940","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.1387},"relatedVulnerabilities":[{"id":"CVE-2026-112940","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112940","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8"],"description":"filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112940","epss":0.0019,"percentile":0.08751,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112940","cwe":"CWE-363","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112940","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-v4x8-3wr5-3wq8","versionConstraint":">=3.20.4,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-v422-hmwv-36x6","dataSource":"https://github.com/advisories/GHSA-v422-hmwv-36x6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6","https://nvd.nist.gov/vuln/detail/CVE-2026-12590","https://github.com/expressjs/body-parser/pull/698","https://github.com/expressjs/body-parser/pull/741","https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d","https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.6","https://github.com/expressjs/body-parser/releases/tag/v2.3.0"],"description":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.6"],"state":"fixed","available":[{"version":"1.20.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.13802},"relatedVulnerabilities":[{"id":"CVE-2026-12590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"],"description":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.5"}},"found":{"vulnerabilityID":"GHSA-v422-hmwv-36x6","versionConstraint":"<1.20.6 (semantic)"},"fix":{"suggestedVersion":"1.20.6"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.5?package-id=04b33f5cfaf593a5","name":"body-parser","version":"1.20.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-6w3j-5fw6-r9vr","dataSource":"https://github.com/advisories/GHSA-6w3j-5fw6-r9vr","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr","https://nvd.nist.gov/vuln/detail/CVE-2026-84368","https://github.com/hapijs/joi/pull/3138","https://github.com/hapijs/joi/pull/3139","https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"],"description":"joi: Prototype pollution via a `__proto__` language key in custom messages","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84368","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84368","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["17.13.6"],"state":"fixed","available":[{"version":"17.13.6","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.130315},"relatedVulnerabilities":[{"id":"CVE-2026-84368","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84368","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa","https://github.com/hapijs/joi/pull/3138","https://github.com/hapijs/joi/pull/3139","https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"],"description":"joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84368","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84368","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.3"}},"found":{"vulnerabilityID":"GHSA-6w3j-5fw6-r9vr","versionConstraint":">=17.2.0,<17.13.6 (semantic)"},"fix":{"suggestedVersion":"17.13.6"}}],"artifact":{"id":"pkg:npm/joi@17.13.3?package-id=5542a1e63c4fcad6","name":"joi","version":"17.13.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:joi:joi:17.13.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-gg4h-3hg2-grpc","dataSource":"https://github.com/advisories/GHSA-gg4h-3hg2-grpc","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc","https://nvd.nist.gov/vuln/detail/CVE-2026-84367","https://github.com/hapijs/joi/pull/3134","https://github.com/hapijs/joi/pull/3135","https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6","https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01","https://github.com/hapijs/joi/releases/tag/v17.13.5","https://github.com/hapijs/joi/releases/tag/v18.2.4"],"description":"joi: object().rename() with a template target can set the validated object's prototype","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84367","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84367","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["17.13.5"],"state":"fixed","available":[{"version":"17.13.5","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.130315},"relatedVulnerabilities":[{"id":"CVE-2026-84367","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84367","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6","https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01","https://github.com/hapijs/joi/pull/3134","https://github.com/hapijs/joi/pull/3135","https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"],"description":"joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84367","epss":0.00389,"percentile":0.33034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84367","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"joi","version":"17.13.3"}},"found":{"vulnerabilityID":"GHSA-gg4h-3hg2-grpc","versionConstraint":">=16.0.0,<17.13.5 (semantic)"},"fix":{"suggestedVersion":"17.13.5"}}],"artifact":{"id":"pkg:npm/joi@17.13.3?package-id=5542a1e63c4fcad6","name":"joi","version":"17.13.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:joi:joi:17.13.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/joi@17.13.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-j8f7-rjxc-mr56","dataSource":"https://github.com/advisories/GHSA-j8f7-rjxc-mr56","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56","https://nvd.nist.gov/vuln/detail/CVE-2026-112936","https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04","https://github.com/tox-dev/filelock/releases/tag/4.0.9"],"description":"filelock: ReadWriteLock follows a symlink at the lock path into SQLite","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112936","epss":0.00232,"percentile":0.1414,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112936","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112936","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.9"],"state":"fixed","available":[{"version":"4.0.9","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.12875999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112936","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112936","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04","https://github.com/tox-dev/filelock/releases/tag/4.0.9","https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56"],"description":"filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112936","epss":0.00232,"percentile":0.1414,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112936","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112936","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-j8f7-rjxc-mr56","versionConstraint":">=3.20.4,<=4.0.8 (python)"},"fix":{"suggestedVersion":"4.0.9"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6wvx-3r32-xmcg","dataSource":"https://github.com/advisories/GHSA-6wvx-3r32-xmcg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg","https://nvd.nist.gov/vuln/detail/CVE-2026-118777","https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118777","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118777","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118777","epss":0.00255,"percentile":0.17162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118777","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-6wvx-3r32-xmcg","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrr3-gc8f-f4qj","dataSource":"https://github.com/advisories/GHSA-hrr3-gc8f-f4qj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472","https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.7","https://github.com/fastify/fast-uri/releases/tag/v3.1.8","https://github.com/fastify/fast-uri/releases/tag/v4.1.5"],"description":"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.8"],"state":"fixed","available":[{"version":"3.1.8","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.12397000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-86472","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj"],"description":"fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-hrr3-gc8f-f4qj","versionConstraint":">=3.0.0,<3.1.8 (semantic)"},"fix":{"suggestedVersion":"3.1.8"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-69hj-f68j-2879","dataSource":"https://github.com/advisories/GHSA-69hj-f68j-2879","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879","https://nvd.nist.gov/vuln/detail/CVE-2026-112909","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.12209999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112909","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879"],"description":"filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-69hj-f68j-2879","versionConstraint":"<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-cwqr-hh33-gh44","dataSource":"https://github.com/advisories/GHSA-cwqr-hh33-gh44","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-cwqr-hh33-gh44","https://nvd.nist.gov/vuln/detail/CVE-2026-112915","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112915","epss":0.00218,"percentile":0.12264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112915","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.11445000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-112915","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112915","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-cwqr-hh33-gh44"],"description":"filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112915","epss":0.00218,"percentile":0.12264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112915","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-cwqr-hh33-gh44","versionConstraint":">=3.20.4,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qx2v-qp2m-jg93","dataSource":"https://github.com/advisories/GHSA-qx2v-qp2m-jg93","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93","https://nvd.nist.gov/vuln/detail/CVE-2026-41305","https://github.com/postcss/postcss/releases/tag/8.5.10"],"description":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.10"],"state":"fixed","available":[{"version":"8.5.10","date":"2026-04-24","kind":"first-observed"}]},"advisories":[],"risk":0.11377499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41305","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/releases/tag/8.5.10","https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"7.0.39"}},"found":{"vulnerabilityID":"GHSA-qx2v-qp2m-jg93","versionConstraint":"<8.5.10 (semantic)"},"fix":{"suggestedVersion":"8.5.10"}}],"artifact":{"id":"pkg:npm/postcss@7.0.39?package-id=6e0b8b643d46db35","name":"postcss","version":"7.0.39","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@7.0.39","upstreams":[]}},{"vulnerability":{"id":"GHSA-qx2v-qp2m-jg93","dataSource":"https://github.com/advisories/GHSA-qx2v-qp2m-jg93","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93","https://nvd.nist.gov/vuln/detail/CVE-2026-41305","https://github.com/postcss/postcss/releases/tag/8.5.10"],"description":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.10"],"state":"fixed","available":[{"version":"8.5.10","date":"2026-04-24","kind":"first-observed"}]},"advisories":[],"risk":0.11377499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41305","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/releases/tag/8.5.10","https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.5.6"}},"found":{"vulnerabilityID":"GHSA-qx2v-qp2m-jg93","versionConstraint":"<8.5.10 (semantic)"},"fix":{"suggestedVersion":"8.5.10"}}],"artifact":{"id":"pkg:npm/postcss@8.5.6?package-id=a16deb6076942246","name":"postcss","version":"8.5.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.5.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.5.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-5cwg-6vw7-rj6p","dataSource":"https://github.com/advisories/GHSA-5cwg-6vw7-rj6p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p","https://nvd.nist.gov/vuln/detail/CVE-2026-119186","https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: AES-GCM authentication bypass via unvalidated tagLength option","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11227000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-119186","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119186","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119186","epss":0.00206,"percentile":0.10693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119186","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-119186","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-5cwg-6vw7-rj6p","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-525v-9gp9-w22h","dataSource":"https://github.com/advisories/GHSA-525v-9gp9-w22h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h","https://nvd.nist.gov/vuln/detail/CVE-2026-118778","https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: TLS client crash when the server sends no certificate","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.11118000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-118778","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118778","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118778","epss":0.00204,"percentile":0.10367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118778","cwe":"CWE-476","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-525v-9gp9-w22h","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4642-5mcj-2rqw","dataSource":"https://github.com/advisories/GHSA-4642-5mcj-2rqw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw","https://nvd.nist.gov/vuln/detail/CVE-2026-118775","https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: ASN.1 OID first arc truncation in asn1.oidToDer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.10485499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118775","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118775","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118775","epss":0.00313,"percentile":0.24276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118775","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4642-5mcj-2rqw","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-333x-w4r6-6crp","dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.10117},"relatedVulnerabilities":[{"id":"CVE-2026-110725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w9m9-85wc-3x92","dataSource":"https://github.com/advisories/GHSA-w9m9-85wc-3x92","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-9358","https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9","https://vuldb.com/submit/813080","https://vuldb.com/vuln/365321","https://vuldb.com/vuln/365321/cti","https://github.com/postcss/postcss-selector-parser/commit/5bc698cef66f8abd12610dc623e5d67cbc0f869d","https://github.com/postcss/postcss-selector-parser/commit/e37c5b0b785b165e27508d2489fdec8e0f18b10a","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.3","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.3","https://vuldb.com/cve/CVE-2026-9358"],"description":"postcss-selector-parser allows denial of service through uncontrolled AST recursion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9358","epss":0.00325,"percentile":0.25608,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9358","cwe":"CWE-404","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-9358","cwe":"CWE-674","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["6.1.3"],"state":"fixed","available":[{"version":"6.1.3","date":"2026-09-01","kind":"first-observed"}]},"advisories":[],"risk":0.10074999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-9358","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9358","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9","https://github.com/postcss/postcss-selector-parser/commit/5bc698cef66f8abd12610dc623e5d67cbc0f869d","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.3","https://vuldb.com/cve/CVE-2026-9358","https://vuldb.com/submit/813080","https://vuldb.com/vuln/365321","https://vuldb.com/vuln/365321/cti"],"description":"A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition \"DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).\" The commits were backported to 6.x branch, which was the most downloaded version.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9358","epss":0.00325,"percentile":0.25608,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9358","cwe":"CWE-404","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-9358","cwe":"CWE-674","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"6.1.2"}},"found":{"vulnerabilityID":"GHSA-w9m9-85wc-3x92","versionConstraint":">=6.1.0,<6.1.3 (semantic)"},"fix":{"suggestedVersion":"6.1.3"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@6.1.2?package-id=f7f4c134629f3b3a","name":"postcss-selector-parser","version":"6.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:6.1.2:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:6.1.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@6.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w9m9-85wc-3x92","dataSource":"https://github.com/advisories/GHSA-w9m9-85wc-3x92","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-9358","https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9","https://vuldb.com/submit/813080","https://vuldb.com/vuln/365321","https://vuldb.com/vuln/365321/cti","https://github.com/postcss/postcss-selector-parser/commit/5bc698cef66f8abd12610dc623e5d67cbc0f869d","https://github.com/postcss/postcss-selector-parser/commit/e37c5b0b785b165e27508d2489fdec8e0f18b10a","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.3","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.3","https://vuldb.com/cve/CVE-2026-9358"],"description":"postcss-selector-parser allows denial of service through uncontrolled AST recursion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9358","epss":0.00325,"percentile":0.25608,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9358","cwe":"CWE-404","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-9358","cwe":"CWE-674","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["7.1.3"],"state":"fixed","available":[{"version":"7.1.3","date":"2026-09-01","kind":"first-observed"}]},"advisories":[],"risk":0.10074999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-9358","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9358","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9","https://github.com/postcss/postcss-selector-parser/commit/5bc698cef66f8abd12610dc623e5d67cbc0f869d","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.3","https://vuldb.com/cve/CVE-2026-9358","https://vuldb.com/submit/813080","https://vuldb.com/vuln/365321","https://vuldb.com/vuln/365321/cti"],"description":"A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition \"DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).\" The commits were backported to 6.x branch, which was the most downloaded version.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9358","epss":0.00325,"percentile":0.25608,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9358","cwe":"CWE-404","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-9358","cwe":"CWE-674","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"7.1.1"}},"found":{"vulnerabilityID":"GHSA-w9m9-85wc-3x92","versionConstraint":">=7.1.0,<7.1.3 (semantic)"},"fix":{"suggestedVersion":"7.1.3"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@7.1.1?package-id=90e1be19281fde27","name":"postcss-selector-parser","version":"7.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:7.1.1:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:7.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@7.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to improper path equivalence in relative reference normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-110095","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.2?package-id=202d0cf321c1eaa3","name":"fast-uri","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-jc66-7q78-782g","dataSource":"https://github.com/advisories/GHSA-jc66-7q78-782g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g","https://nvd.nist.gov/vuln/detail/CVE-2026-118782","https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.09375},"relatedVulnerabilities":[{"id":"CVE-2026-118782","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118782","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118782","epss":0.00125,"percentile":0.02194,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118782","cwe":"CWE-354","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118782","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-jc66-7q78-782g","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mx8g-39q3-5c79","dataSource":"https://github.com/advisories/GHSA-mx8g-39q3-5c79","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79","https://nvd.nist.gov/vuln/detail/CVE-2026-9595","https://github.com/facebook/create-react-app/pull/7444","https://github.com/webpack/webpack-dev-server/pull/4316","https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","https://cna.openjsf.org/security-advisories.html"],"description":"webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9595","epss":0.00163,"percentile":0.05469,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9595","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-9595","cwe":"CWE-441","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["5.2.5"],"state":"fixed","available":[{"version":"5.2.5","date":"2026-06-18","kind":"first-observed"}]},"advisories":[],"risk":0.08394499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-9595","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/facebook/create-react-app/pull/7444","https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","https://github.com/webpack/webpack-dev-server/pull/4316","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79"],"description":"Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).\n\nPatches: Fixed in webpack-dev-server@5.2.5.\n\nWorkarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9595","epss":0.00163,"percentile":0.05469,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9595","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-9595","cwe":"CWE-441","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack-dev-server","version":"4.15.2"}},"found":{"vulnerabilityID":"GHSA-mx8g-39q3-5c79","versionConstraint":"<5.2.5 (semantic)"},"fix":{"suggestedVersion":"5.2.5"}}],"artifact":{"id":"pkg:npm/webpack-dev-server@4.15.2?package-id=a36aabc20adb299f","name":"webpack-dev-server","version":"4.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack-dev-server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev-server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev_server:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack-dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack_dev:webpack_dev_server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack-dev-server:4.15.2:*:*:*:*:*:*:*","cpe:2.3:a:webpack:webpack_dev_server:4.15.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/webpack-dev-server@4.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-m5mm-p8h7-m29v","dataSource":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3"],"description":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115897","epss":0.00307,"percentile":0.23501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115897","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.1.3"],"state":"fixed","available":[{"version":"7.1.3","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.078285},"relatedVulnerabilities":[{"id":"CVE-2026-115897","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115897","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v"],"description":"Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115897","epss":0.00307,"percentile":0.23501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115897","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-m5mm-p8h7-m29v","versionConstraint":"<7.1.3 (semantic)"},"fix":{"suggestedVersion":"7.1.3"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=c17a204c63311f3d","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rfpc-qcw5-3pc4","dataSource":"https://github.com/advisories/GHSA-rfpc-qcw5-3pc4","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4","https://nvd.nist.gov/vuln/detail/CVE-2026-112939","https://github.com/tox-dev/filelock/pull/836","https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5b3cc","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112939","epss":0.0014,"percentile":0.03299,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112939","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.0679},"relatedVulnerabilities":[{"id":"CVE-2026-112939","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112939","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5b3cc","https://github.com/tox-dev/filelock/pull/836","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4"],"description":"filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112939","epss":0.0014,"percentile":0.03299,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112939","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-rfpc-qcw5-3pc4","versionConstraint":">=3.22.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-fq56-3cx3-fjxp","dataSource":"https://github.com/advisories/GHSA-fq56-3cx3-fjxp","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp","https://nvd.nist.gov/vuln/detail/CVE-2026-112935","https://github.com/tox-dev/filelock/pull/843","https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112935","epss":0.00132,"percentile":0.02756,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112935","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.06402},"relatedVulnerabilities":[{"id":"CVE-2026-112935","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112935","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b","https://github.com/tox-dev/filelock/pull/843","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp"],"description":"filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112935","epss":0.00132,"percentile":0.02756,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112935","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-fq56-3cx3-fjxp","versionConstraint":">=3.22.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4487-j8r4-4g2f","dataSource":"https://github.com/advisories/GHSA-4487-j8r4-4g2f","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f","https://nvd.nist.gov/vuln/detail/CVE-2026-118780","https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.05761999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118780","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118780","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118780","epss":0.00172,"percentile":0.06586,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118780","cwe":"CWE-295","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118780","cwe":"CWE-471","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-4487-j8r4-4g2f","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.29.0?package-id=d6c59bf523299781","name":"@babel/core","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.29.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h6cr-wjv9-3cpp","dataSource":"https://github.com/advisories/GHSA-h6cr-wjv9-3cpp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp","https://nvd.nist.gov/vuln/detail/CVE-2026-118781","https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"],"description":"Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.035105},"relatedVulnerabilities":[{"id":"CVE-2026-118781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118781","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118781","epss":0.00119,"percentile":0.01735,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118781","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-forge","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-h6cr-wjv9-3cpp","versionConstraint":"<=1.4.0 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/node-forge@1.4.0?package-id=c1e5f20287afef44","name":"node-forge","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause OR GPL-2.0"],"cpes":["cpe:2.3:a:digitalbazaar:forge:1.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-forge@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6q48-6c7w-9gw2","dataSource":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2","https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576","https://emudhra.we-have-a-problem.com"],"description":"certifi bundles emSign root CAs with compromised intermediate CA keys","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"vendorMetadata":{}}],"fix":{"versions":["2026.10.18"],"state":"fixed","available":[{"version":"2026.10.18","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"certifi","version":"2026.4.22"}},"found":{"vulnerabilityID":"GHSA-6q48-6c7w-9gw2","versionConstraint":">=2019.03.09,<2026.10.18 (python)"},"fix":{"suggestedVersion":"2026.10.18"}}],"artifact":{"id":"pkg:pypi/certifi@2026.4.22?package-id=5c5b6bd00fbd57ee","name":"certifi","version":"2026.4.22","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:certifi:certifi:2026.4.22:*:*:*:*:python:*:*"],"purl":"pkg:pypi/certifi@2026.4.22","upstreams":[]}},{"vulnerability":{"id":"GHSA-m38p-3v84-rcjg","dataSource":"https://github.com/advisories/GHSA-m38p-3v84-rcjg","namespace":"github:language:javascript","severity":"Critical","urls":[],"description":"Malware in cloudsplaining","cvss":[],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cloudsplaining","version":"0.4.8"}},"found":{"vulnerabilityID":"GHSA-m38p-3v84-rcjg","versionConstraint":">=0 (semantic)"}}],"artifact":{"id":"pkg:npm/cloudsplaining@0.4.8?package-id=7e6a5bf17949f3a3","name":"cloudsplaining","version":"0.4.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cloudsplaining:cloudsplaining:0.4.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/cloudsplaining@0.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-5xjx-3w67-w9x9","dataSource":"https://github.com/advisories/GHSA-5xjx-3w67-w9x9","namespace":"github:language:github-action","severity":"Critical","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9"],"description":"pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"fix":{"versions":["1.14.3"],"state":"fixed","available":[{"version":"1.14.3","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"v1.13.0"}},"found":{"vulnerabilityID":"GHSA-5xjx-3w67-w9x9","versionConstraint":"<=1.14.2 (unknown)"},"fix":{"suggestedVersion":"1.14.3"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@v1.13.0?package-id=9c73af160d1feba5","name":"pypa/gh-action-pypi-publish","version":"v1.13.0","type":"github-action","locations":[{"path":"/.github/workflows/publish.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:v1.13.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:v1.13.0:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@v1.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g2v6-rqmx-r4w6","dataSource":"https://github.com/advisories/GHSA-g2v6-rqmx-r4w6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vuejs/core/security/advisories/GHSA-g2v6-rqmx-r4w6","https://github.com/vuejs/core/pull/15266","https://github.com/vuejs/core/commit/a2b40db9a83b36ed9da3a16403cf8f040262d73f","https://github.com/vuejs/core/releases/tag/v3.5.42","https://github.com/vuejs/core/releases/tag/v3.6.0-rc.6"],"description":"@vue/server-renderer: XSS via missing CR in attribute-name blacklist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"fix":{"versions":["3.5.42"],"state":"fixed","available":[{"version":"3.5.42","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vue/server-renderer","version":"3.5.29"}},"found":{"vulnerabilityID":"GHSA-g2v6-rqmx-r4w6","versionConstraint":"<3.5.42 (semantic)"},"fix":{"suggestedVersion":"3.5.42"}}],"artifact":{"id":"pkg:npm/%40vue/server-renderer@3.5.29?package-id=f5cb2d6b2a7286d1","name":"@vue/server-renderer","version":"3.5.29","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@vue\\/server-renderer:\\@vue\\/server-renderer:3.5.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@vue\\/server-renderer:\\@vue\\/server_renderer:3.5.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@vue\\/server_renderer:\\@vue\\/server-renderer:3.5.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@vue\\/server_renderer:\\@vue\\/server_renderer:3.5.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@vue\\/server:\\@vue\\/server-renderer:3.5.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@vue\\/server:\\@vue\\/server_renderer:3.5.29:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vue/server-renderer@3.5.29","upstreams":[]}},{"vulnerability":{"id":"GHSA-537c-gmf6-5ccf","dataSource":"https://github.com/advisories/GHSA-537c-gmf6-5ccf","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyca/cryptography/security/advisories/GHSA-537c-gmf6-5ccf","https://openssl-library.org/news/secadv/20260609.txt"],"description":"Vulnerable OpenSSL included in cryptography wheels","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["48.0.1"],"state":"fixed","available":[{"version":"48.0.1","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"cryptography","version":"48.0.0"}},"found":{"vulnerabilityID":"GHSA-537c-gmf6-5ccf","versionConstraint":">=0.5.0,<48.0.1 (python)"},"fix":{"suggestedVersion":"48.0.1"}}],"artifact":{"id":"pkg:pypi/cryptography@48.0.0?package-id=5deb53d1c2bc98e4","name":"cryptography","version":"48.0.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:cryptography.io:cryptography:48.0.0:*:*:*:*:python:*:*","cpe:2.3:a:cryptography.io:cryptography:48.0.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/cryptography@48.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.1?package-id=15e5564f07e87e23","name":"js-yaml","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5c6j-r48x-rmvq","dataSource":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq","https://nvd.nist.gov/vuln/detail/CVE-2020-7660","https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9","https://github.com/advisories/GHSA-hxcc-f52p-wc94","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3"],"description":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["7.0.3"],"state":"fixed","available":[{"version":"7.0.3","date":"2026-02-28","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-5c6j-r48x-rmvq","versionConstraint":"<=7.0.2 (semantic)"},"fix":{"suggestedVersion":"7.0.3"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.2?package-id=c17a204c63311f3d","name":"serialize-javascript","version":"6.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8mx5-7m5m-r77g","dataSource":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112910","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-8mx5-7m5m-r77g","versionConstraint":">=3.10.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-253c-mchw-3w2r","dataSource":"https://github.com/advisories/GHSA-253c-mchw-3w2r","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49"],"description":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"fix":{"versions":["14.3.1"],"state":"fixed","available":[{"version":"14.3.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.1"}},"found":{"vulnerabilityID":"GHSA-253c-mchw-3w2r","versionConstraint":"<14.3.1 (semantic)"},"fix":{"suggestedVersion":"14.3.1"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.1?package-id=6b11c2f95d0a8dbc","name":"markdown-it","version":"14.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-567q-5qvw-pf92","dataSource":"https://github.com/advisories/GHSA-567q-5qvw-pf92","namespace":"github:language:python","severity":"Low","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112907","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-567q-5qvw-pf92","versionConstraint":">=3.22.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9vhv-jxww-xfm5","dataSource":"https://github.com/advisories/GHSA-9vhv-jxww-xfm5","namespace":"github:language:python","severity":"Low","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112913","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.29.0"}},"found":{"vulnerabilityID":"GHSA-9vhv-jxww-xfm5","versionConstraint":">=3.20.4,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.29.0?package-id=d30c5552ca65821c","name":"filelock","version":"3.29.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.29.0:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.29.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.29.0","upstreams":[]}}],"source":{"type":"file","target":"salesforce/cloudsplaining"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:28.930589044Z"}}