{"matches":[{"vulnerability":{"id":"GHSA-5cgq-3rg8-m6cv","dataSource":"https://github.com/advisories/GHSA-5cgq-3rg8-m6cv","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-42508","https://go.dev/cl/781220","https://go.dev/issue/79568","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5021","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/security/cve/CVE-2026-42508","https://bugzilla.redhat.com/show_bug.cgi?id=2480688","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40138","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40945"],"description":"golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42508","epss":0.0691,"percentile":0.94091,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":6.25355},"relatedVulnerabilities":[{"id":"CVE-2026-42508","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42508","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781220","https://go.dev/issue/79568","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5021","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-42508","https://bugzilla.redhat.com/show_bug.cgi?id=2480688","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json"],"description":"Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42508","epss":0.0691,"percentile":0.94091,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-5cgq-3rg8-m6cv","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-5j98-mcp5-4vw2","dataSource":"https://github.com/advisories/GHSA-5j98-mcp5-4vw2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://nvd.nist.gov/vuln/detail/CVE-2025-64756","https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f"],"description":"glob CLI: Command injection via -c/--cmd executes matches with shell:true","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.0309,"percentile":0.87716,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.0"],"state":"fixed","available":[{"version":"10.5.0","date":"2025-11-19","kind":"first-observed"}]},"advisories":[],"risk":2.3175},"relatedVulnerabilities":[{"id":"CVE-2025-64756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2"],"description":"Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.0309,"percentile":0.87716,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.3.12"}},"found":{"vulnerabilityID":"GHSA-5j98-mcp5-4vw2","versionConstraint":">=10.2.0,<10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.0"}}],"artifact":{"id":"pkg:npm/glob@10.3.12?package-id=38c1a51c0b74cf6a","name":"glob","version":"10.3.12","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:isaacs:glob:10.3.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.3.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-5j98-mcp5-4vw2","dataSource":"https://github.com/advisories/GHSA-5j98-mcp5-4vw2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://nvd.nist.gov/vuln/detail/CVE-2025-64756","https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f"],"description":"glob CLI: Command injection via -c/--cmd executes matches with shell:true","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.0309,"percentile":0.87716,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.0"],"state":"fixed","available":[{"version":"10.5.0","date":"2025-11-19","kind":"first-observed"}]},"advisories":[],"risk":2.3175},"relatedVulnerabilities":[{"id":"CVE-2025-64756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2"],"description":"Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.0309,"percentile":0.87716,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.3.15"}},"found":{"vulnerabilityID":"GHSA-5j98-mcp5-4vw2","versionConstraint":">=10.2.0,<10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.0"}}],"artifact":{"id":"pkg:npm/glob@10.3.15?package-id=5e86db32f3c82b61","name":"glob","version":"10.3.15","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.3.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.3.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.19024},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-2w6w-674q-4c4q","dataSource":"https://github.com/advisories/GHSA-2w6w-674q-4c4q","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33937"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33937","epss":0.01907,"percentile":0.79759,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":1.7925800000000003},"relatedVulnerabilities":[{"id":"CVE-2026-33937","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33937","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33937","https://bugzilla.redhat.com/show_bug.cgi?id=2452523","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33937.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling `Handlebars.compile()`; ensure the argument is always a  `string`, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time; `compile()` will be unavailable.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33937","epss":0.01907,"percentile":0.79759,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-2w6w-674q-4c4q","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5026","dataSource":"https://go.dev/cl/767220","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.8,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39821","epss":0.01834,"percentile":0.78914,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":1.4396899999999997},"relatedVulnerabilities":[{"id":"CVE-2026-39821","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.8,"impactScore":5.8},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"exploitabilityScore":3.2,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39821","epss":0.01834,"percentile":0.78914,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-p77j-4mvh-x3m3","dataSource":"https://github.com/advisories/GHSA-p77j-4mvh-x3m3","namespace":"github:language:go","severity":"Critical","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3","https://nvd.nist.gov/vuln/detail/CVE-2026-33186"],"description":"gRPC-Go has an authorization bypass via missing leading slash in :path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33186","epss":0.01584,"percentile":0.75571,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33186","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33186","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.79.3"],"state":"fixed","available":[{"version":"1.79.3","date":"2026-03-19","kind":"first-observed"}]},"advisories":[],"risk":1.4335200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33186","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33186","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:10094","https://access.redhat.com/errata/RHSA-2026:10105","https://access.redhat.com/errata/RHSA-2026:10107","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10126","https://access.redhat.com/errata/RHSA-2026:10130","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10153","https://access.redhat.com/errata/RHSA-2026:10155","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10172","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10698","https://access.redhat.com/errata/RHSA-2026:10705","https://access.redhat.com/errata/RHSA-2026:10706","https://access.redhat.com/errata/RHSA-2026:11070","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11803","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12116","https://access.redhat.com/errata/RHSA-2026:12118","https://access.redhat.com/errata/RHSA-2026:12119","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12283","https://access.redhat.com/errata/RHSA-2026:12337","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14775","https://access.redhat.com/errata/RHSA-2026:15092","https://access.redhat.com/errata/RHSA-2026:17123","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17459","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17475","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17599","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18068","https://access.redhat.com/errata/RHSA-2026:18585","https://access.redhat.com/errata/RHSA-2026:19099","https://access.redhat.com/errata/RHSA-2026:19108","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:20034","https://access.redhat.com/errata/RHSA-2026:20035","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20089","https://access.redhat.com/errata/RHSA-2026:20322","https://access.redhat.com/errata/RHSA-2026:20436","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21692","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21697","https://access.redhat.com/errata/RHSA-2026:21703","https://access.redhat.com/errata/RHSA-2026:21704","https://access.redhat.com/errata/RHSA-2026:21709","https://access.redhat.com/errata/RHSA-2026:21710","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21931","https://access.redhat.com/errata/RHSA-2026:21932","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22645","https://access.redhat.com/errata/RHSA-2026:22689","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22800","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23234","https://access.redhat.com/errata/RHSA-2026:23235","https://access.redhat.com/errata/RHSA-2026:23241","https://access.redhat.com/errata/RHSA-2026:23246","https://access.redhat.com/errata/RHSA-2026:23247","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24484","https://access.redhat.com/errata/RHSA-2026:24506","https://access.redhat.com/errata/RHSA-2026:24535","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24759","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25009","https://access.redhat.com/errata/RHSA-2026:25045","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25182","https://access.redhat.com/errata/RHSA-2026:25183","https://access.redhat.com/errata/RHSA-2026:25187","https://access.redhat.com/errata/RHSA-2026:25194","https://access.redhat.com/errata/RHSA-2026:25195","https://access.redhat.com/errata/RHSA-2026:25201","https://access.redhat.com/errata/RHSA-2026:26412","https://access.redhat.com/errata/RHSA-2026:26413","https://access.redhat.com/errata/RHSA-2026:26416","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26519","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26997","https://access.redhat.com/errata/RHSA-2026:26999","https://access.redhat.com/errata/RHSA-2026:27001","https://access.redhat.com/errata/RHSA-2026:27004","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:27712","https://access.redhat.com/errata/RHSA-2026:27856","https://access.redhat.com/errata/RHSA-2026:27892","https://access.redhat.com/errata/RHSA-2026:27893","https://access.redhat.com/errata/RHSA-2026:27901","https://access.redhat.com/errata/RHSA-2026:27957","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29079","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:34049","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34099","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34769","https://access.redhat.com/errata/RHSA-2026:34794","https://access.redhat.com/errata/RHSA-2026:34795","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:37192","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37580","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:40022","https://access.redhat.com/errata/RHSA-2026:40030","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43225","https://access.redhat.com/errata/RHSA-2026:43227","https://access.redhat.com/errata/RHSA-2026:43253","https://access.redhat.com/errata/RHSA-2026:43331","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44233","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:53728","https://access.redhat.com/errata/RHSA-2026:53763","https://access.redhat.com/errata/RHSA-2026:53773","https://access.redhat.com/errata/RHSA-2026:53804","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56959","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60146","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:6174","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7110","https://access.redhat.com/errata/RHSA-2026:7128","https://access.redhat.com/errata/RHSA-2026:7245","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8449","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9388","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-33186","https://bugzilla.redhat.com/show_bug.cgi?id=2449833","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json"],"description":"gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33186","epss":0.01584,"percentile":0.75571,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33186","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33186","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.69.4"}},"found":{"vulnerabilityID":"GHSA-p77j-4mvh-x3m3","versionConstraint":"<1.79.3 (go)"},"fix":{"suggestedVersion":"1.79.3"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.69.4?package-id=1f850ee01658c705","name":"google.golang.org/grpc","version":"v1.69.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.69.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.69.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A="}}},{"vulnerability":{"id":"GHSA-r275-fr43-pm7q","dataSource":"https://github.com/advisories/GHSA-r275-fr43-pm7q","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257","https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292","https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q","https://nvd.nist.gov/vuln/detail/CVE-2026-28292","https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292"],"description":"simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-28292","epss":0.01348,"percentile":0.71473,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-28292","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-28292","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-28292","cwe":"CWE-76","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.32.3"],"state":"fixed","available":[{"version":"3.32.3","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":1.2671200000000002},"relatedVulnerabilities":[{"id":"CVE-2026-28292","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28292","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/steveukx/git-js/commit/f7042088aa2dac59e3c49a84d7a2f4b26048a257","https://github.com/steveukx/git-js/security/advisories/GHSA-r275-fr43-pm7q","https://www.codeant.ai/security-research/security-research-simple-git-remote-code-execution-cve-2026-28292","https://access.redhat.com/security/cve/CVE-2026-28292","https://bugzilla.redhat.com/show_bug.cgi?id=2446162","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28292.json","https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292"],"description":"`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-28292","epss":0.01348,"percentile":0.71473,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-28292","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-28292","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-28292","cwe":"CWE-76","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"simple-git","version":"3.24.0"}},"found":{"vulnerabilityID":"GHSA-r275-fr43-pm7q","versionConstraint":">=3.15.0,<3.32.3 (semantic)"},"fix":{"suggestedVersion":"3.32.3"}}],"artifact":{"id":"pkg:npm/simple-git@3.24.0?package-id=645a8534891a91f8","name":"simple-git","version":"3.24.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:simple-git_project:simple-git:3.24.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/simple-git@3.24.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":1.066455},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-vrm6-8vpv-qv8q","dataSource":"https://github.com/advisories/GHSA-vrm6-8vpv-qv8q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q","https://nvd.nist.gov/vuln/detail/CVE-2026-1526","https://hackerone.com/reports/3481206","https://cna.openjsf.org/security-advisories.html","https://datatracker.ietf.org/doc/html/rfc7692","https://owasp.org/www-community/attacks/Denial_of_Service"],"description":"Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-1526","epss":0.01196,"percentile":0.68099,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-1526","cwe":"CWE-409","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-1526","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.24.0"],"state":"fixed","available":[{"version":"6.24.0","date":"2026-03-14","kind":"first-observed"}]},"advisories":[],"risk":0.897},"relatedVulnerabilities":[{"id":"CVE-2026-1526","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1526","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://datatracker.ietf.org/doc/html/rfc7692","https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q","https://hackerone.com/reports/3481206","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:21931","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:7080","https://access.redhat.com/errata/RHSA-2026:7123","https://access.redhat.com/errata/RHSA-2026:7302","https://access.redhat.com/errata/RHSA-2026:7310","https://access.redhat.com/errata/RHSA-2026:7350","https://access.redhat.com/errata/RHSA-2026:7670","https://access.redhat.com/errata/RHSA-2026:7675","https://access.redhat.com/errata/RHSA-2026:7983","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-1526","https://bugzilla.redhat.com/show_bug.cgi?id=2447142","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1526.json"],"description":"The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a \"decompression bomb\") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.\n\nThe vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-1526","epss":0.01196,"percentile":0.68099,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-1526","cwe":"CWE-409","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-1526","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-vrm6-8vpv-qv8q","versionConstraint":"<6.24.0 (semantic)"},"fix":{"suggestedVersion":"6.24.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-66mm-25pp-rfff","dataSource":"https://github.com/advisories/GHSA-66mm-25pp-rfff","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jsonata-js/jsonata/security/advisories/GHSA-66mm-25pp-rfff","https://github.com/jsonata-js/jsonata/pull/799","https://github.com/jsonata-js/jsonata/pull/800","https://github.com/jsonata-js/jsonata/pull/802","https://github.com/jsonata-js/jsonata/commit/47c0e58542202c705726663166dbee5fcae47d06","https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e","https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2","https://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159","https://github.com/jsonata-js/jsonata/commit/f174348c7fa30f271b63ddedf0767e814004bc4d","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1"],"description":"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77415","epss":0.00892,"percentile":0.59436,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77415","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.2.1"],"state":"fixed","available":[{"version":"2.2.1","date":"2026-08-22","kind":"first-observed"}]},"advisories":[],"risk":0.81618},"relatedVulnerabilities":[{"id":"CVE-2026-77415","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77415","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jsonata-js/jsonata/commit/47c0e58542202c705726663166dbee5fcae47d06","https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e","https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2","https://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159","https://github.com/jsonata-js/jsonata/commit/f174348c7fa30f271b63ddedf0767e814004bc4d","https://github.com/jsonata-js/jsonata/pull/799","https://github.com/jsonata-js/jsonata/pull/800","https://github.com/jsonata-js/jsonata/pull/802","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1","https://github.com/jsonata-js/jsonata/security/advisories/GHSA-66mm-25pp-rfff"],"description":"JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77415","epss":0.00892,"percentile":0.59436,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77415","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonata","version":"2.0.5"}},"found":{"vulnerabilityID":"GHSA-66mm-25pp-rfff","versionConstraint":">=2.0.0,<2.2.1 (semantic)"},"fix":{"suggestedVersion":"2.2.1"}}],"artifact":{"id":"pkg:npm/jsonata@2.0.5?package-id=25fabe95ef4fd484","name":"jsonata","version":"2.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:jsonata:jsonata:2.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/jsonata@2.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-qpx9-hpmf-5gmw","dataSource":"https://github.com/advisories/GHSA-qpx9-hpmf-5gmw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw","https://github.com/jashkenas/underscore/issues/3011","https://underscorejs.org/#1.13.8","https://underscorejs.org/#flatten","https://underscorejs.org/#isEqual","https://nvd.nist.gov/vuln/detail/CVE-2026-27601","https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4","https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84"],"description":"Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27601","epss":0.01063,"percentile":0.6463,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27601","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.13.8"],"state":"fixed","available":[{"version":"1.13.8","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.7733325000000001},"relatedVulnerabilities":[{"id":"CVE-2026-27601","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27601","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4","https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84","https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw"],"description":"Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to _.flatten. In the case of _.isEqual, the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using _.isEqual. For example, if a client submits data that are stored in a database, and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously, OR if a client submits a single request, but its data are parsed twice, creating two non-identical but equivalent datastructures that are then compared. Exceptions originating from the call to _.flatten or _.isEqual, as a result of a stack overflow, are not being caught. This vulnerability is fixed in 1.13.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27601","epss":0.01063,"percentile":0.6463,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27601","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"underscore","version":"1.13.6"}},"found":{"vulnerabilityID":"GHSA-qpx9-hpmf-5gmw","versionConstraint":"<=1.13.7 (semantic)"},"fix":{"suggestedVersion":"1.13.8"}}],"artifact":{"id":"pkg:npm/underscore@1.13.6?package-id=49252d81d65a0672","name":"underscore","version":"1.13.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:underscorejs:underscore:1.13.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/underscore@1.13.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r5x-fm3f-whwj","dataSource":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj","https://nvd.nist.gov/vuln/detail/CVE-2026-106446","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106446","epss":0.00786,"percentile":0.56142,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106446","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.73884},"relatedVulnerabilities":[{"id":"CVE-2026-106446","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106446","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106446","epss":0.00786,"percentile":0.56142,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106446","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-8r5x-fm3f-whwj","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@4.0.5?package-id=8f1a15b330948c74","name":"micromatch","version":"4.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:4.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@4.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@4.0.5?package-id=07c044e442f017b2","name":"micromatch","version":"4.0.5","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:4.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@4.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-hffm-xvc3-vprc","dataSource":"https://github.com/advisories/GHSA-hffm-xvc3-vprc","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-6951","https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8","https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6","https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078"],"description":"simple-git is vulnerable to Remote Code Execution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6951","epss":0.00877,"percentile":0.59042,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6951","cwe":"CWE-94","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2026-6951","cwe":"CWE-88","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.36.0"],"state":"fixed","available":[{"version":"3.36.0","date":"2026-05-06","kind":"first-observed"}]},"advisories":[],"risk":0.723525},"relatedVulnerabilities":[{"id":"CVE-2026-6951","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6951","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/KKC73/02d1d97f3410756095b501fda0ac8ca6","https://github.com/steveukx/git-js/commit/89a2294febed5dfe737c4c735d936bb6018746a8","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16300211","https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078","https://access.redhat.com/security/cve/CVE-2026-6951","https://bugzilla.redhat.com/show_bug.cgi?id=2461750","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6951.json"],"description":"Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed to simple-git, an attacker may still achieve remote code execution by enabling protocol.ext.allow=always and using an ext:: clone source.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6951","epss":0.00877,"percentile":0.59042,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6951","cwe":"CWE-94","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2026-6951","cwe":"CWE-88","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"simple-git","version":"3.24.0"}},"found":{"vulnerabilityID":"GHSA-hffm-xvc3-vprc","versionConstraint":"<3.36.0 (semantic)"},"fix":{"suggestedVersion":"3.36.0"}}],"artifact":{"id":"pkg:npm/simple-git@3.24.0?package-id=645a8534891a91f8","name":"simple-git","version":"3.24.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:simple-git_project:simple-git:3.24.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/simple-git@3.24.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jmr7-xgp7-cmfj","dataSource":"https://github.com/advisories/GHSA-jmr7-xgp7-cmfj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj","https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6","https://nvd.nist.gov/vuln/detail/CVE-2026-26278"],"description":"fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26278","epss":0.00937,"percentile":0.60866,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26278","cwe":"CWE-776","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-26278","cwe":"CWE-776","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.5.4"],"state":"fixed","available":[{"version":"4.5.4","date":"2026-02-28","kind":"first-observed"}]},"advisories":[],"risk":0.70275},"relatedVulnerabilities":[{"id":"CVE-2026-26278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:6174","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7110","https://access.redhat.com/errata/RHSA-2026:7128","https://access.redhat.com/security/cve/CVE-2026-26278","https://bugzilla.redhat.com/show_bug.cgi?id=2441120","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json"],"description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26278","epss":0.00937,"percentile":0.60866,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26278","cwe":"CWE-776","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-26278","cwe":"CWE-776","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-xml-parser","version":"4.2.5"}},"found":{"vulnerabilityID":"GHSA-jmr7-xgp7-cmfj","versionConstraint":">=4.1.3,<4.5.4 (semantic)"},"fix":{"suggestedVersion":"4.5.4"}}],"artifact":{"id":"pkg:npm/fast-xml-parser@4.2.5?package-id=7b31b6b780a1a92a","name":"fast-xml-parser","version":"4.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:naturalintelligence:fast-xml-parser:4.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/fast-xml-parser@4.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-rf6f-7fwh-wjgh","dataSource":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh","https://nvd.nist.gov/vuln/detail/CVE-2026-33228","https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802","https://github.com/WebReflection/flatted/releases/tag/v3.4.2","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-33228","https://bugzilla.redhat.com/show_bug.cgi?id=2449872"],"description":"Prototype Pollution via parse() in NodeJS flatted","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33228","epss":0.00838,"percentile":0.57795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33228","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33228","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.4.2"],"state":"fixed","available":[{"version":"3.4.2","date":"2026-03-20","kind":"first-observed"}]},"advisories":[],"risk":0.6871600000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33228","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802","https://github.com/WebReflection/flatted/releases/tag/v3.4.2","https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-33228","https://bugzilla.redhat.com/show_bug.cgi?id=2449872","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33228.json"],"description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33228","epss":0.00838,"percentile":0.57795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33228","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33228","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"flatted","version":"3.2.7"}},"found":{"vulnerabilityID":"GHSA-rf6f-7fwh-wjgh","versionConstraint":"<=3.4.1 (semantic)"},"fix":{"suggestedVersion":"3.4.2"}}],"artifact":{"id":"pkg:npm/flatted@3.2.7?package-id=feb80a8ab596b6dd","name":"flatted","version":"3.2.7","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:flatted:flatted:3.2.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/flatted@3.2.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-v9p9-hfj2-hcw8","dataSource":"https://github.com/advisories/GHSA-v9p9-hfj2-hcw8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8","https://nvd.nist.gov/vuln/detail/CVE-2026-2229","https://hackerone.com/reports/3487486","https://cna.openjsf.org/security-advisories.html","https://datatracker.ietf.org/doc/html/rfc7692","https://nodejs.org/api/zlib.html#class-zlibinflateraw"],"description":"Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2229","epss":0.00909,"percentile":0.59969,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2229","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-2229","cwe":"CWE-1284","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-2229","cwe":"CWE-248","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.24.0"],"state":"fixed","available":[{"version":"6.24.0","date":"2026-03-14","kind":"first-observed"}]},"advisories":[],"risk":0.6817500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-2229","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://datatracker.ietf.org/doc/html/rfc7692","https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8","https://hackerone.com/reports/3487486","https://nodejs.org/api/zlib.html#class-zlibinflateraw","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:21931","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:7080","https://access.redhat.com/errata/RHSA-2026:7123","https://access.redhat.com/errata/RHSA-2026:7302","https://access.redhat.com/errata/RHSA-2026:7310","https://access.redhat.com/errata/RHSA-2026:7350","https://access.redhat.com/errata/RHSA-2026:7670","https://access.redhat.com/errata/RHSA-2026:7675","https://access.redhat.com/errata/RHSA-2026:7983","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-2229","https://bugzilla.redhat.com/show_bug.cgi?id=2447143","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2229.json"],"description":"ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.\n\nThe vulnerability exists because:\n\n  *  The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15\n  *  The createInflateRaw() call is not wrapped in a try-catch block\n  *  The resulting exception propagates up through the call stack and crashes the Node.js process","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2229","epss":0.00909,"percentile":0.59969,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2229","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-2229","cwe":"CWE-1284","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-2229","cwe":"CWE-248","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-v9p9-hfj2-hcw8","versionConstraint":"<6.24.0 (semantic)"},"fix":{"suggestedVersion":"6.24.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8gq3-vp5j-2grp","dataSource":"https://github.com/advisories/GHSA-8gq3-vp5j-2grp","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp","https://github.com/jsonata-js/jsonata/pull/794","https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e","https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0"],"description":"JSONata: Arbitrary Code Execution via crafted JSONata expressions","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77413","epss":0.00719,"percentile":0.53899,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77413","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.2.0"],"state":"fixed","available":[{"version":"2.2.0","date":"2026-08-22","kind":"first-observed"}]},"advisories":[],"risk":0.657885},"relatedVulnerabilities":[{"id":"CVE-2026-77413","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77413","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jsonata-js/jsonata/commit/4b217d514376e30cba278941298d7ba97c4a6c6e","https://github.com/jsonata-js/jsonata/commit/4c5f4adfb90a9b500889d50f90050ca68888b50d","https://github.com/jsonata-js/jsonata/pull/794","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0","https://github.com/jsonata-js/jsonata/security/advisories/GHSA-8gq3-vp5j-2grp"],"description":"JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77413","epss":0.00719,"percentile":0.53899,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77413","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonata","version":"2.0.5"}},"found":{"vulnerabilityID":"GHSA-8gq3-vp5j-2grp","versionConstraint":">=2.0.0,<2.2.0 (semantic)"},"fix":{"suggestedVersion":"2.2.0"}}],"artifact":{"id":"pkg:npm/jsonata@2.0.5?package-id=25fabe95ef4fd484","name":"jsonata","version":"2.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:jsonata:jsonata:2.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/jsonata@2.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.0.5"],"state":"fixed","available":[{"version":"7.0.5","date":"2024-11-16","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"7.0.3"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":">=7.0.0,<7.0.5 (semantic)"},"fix":{"suggestedVersion":"7.0.5"}}],"artifact":{"id":"pkg:npm/cross-spawn@7.0.3?package-id=8c70e3367a662c19","name":"cross-spawn","version":"7.0.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:7.0.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@7.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.0.5"],"state":"fixed","available":[{"version":"7.0.5","date":"2024-11-16","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"7.0.3"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":">=7.0.0,<7.0.5 (semantic)"},"fix":{"suggestedVersion":"7.0.5"}}],"artifact":{"id":"pkg:npm/cross-spawn@7.0.3?package-id=deb2092eef3e1aa4","name":"cross-spawn","version":"7.0.3","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:7.0.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@7.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-xcpc-8h2w-3j85","dataSource":"https://github.com/advisories/GHSA-xcpc-8h2w-3j85","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39244","https://github.com/cthackers/adm-zip/issues/568","https://github.com/cthackers/adm-zip/commit/2450dcf417aa29df49270237d18c5245794da3e2","https://github.com/cthackers/adm-zip/releases"],"description":"adm-zip: Crafted ZIP file triggers 4GB memory allocation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39244","epss":0.00841,"percentile":0.57895,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39244","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.6.0"],"state":"fixed","available":[{"version":"0.6.0","date":"2026-07-18","kind":"first-observed"}]},"advisories":[],"risk":0.63075},"relatedVulnerabilities":[{"id":"CVE-2026-39244","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39244","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/cthackers/adm-zip","https://github.com/cthackers/adm-zip/issues/568","https://www.npmjs.com/package/adm-zip"],"description":"adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39244","epss":0.00841,"percentile":0.57895,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39244","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"adm-zip","version":"0.5.12"}},"found":{"vulnerabilityID":"GHSA-xcpc-8h2w-3j85","versionConstraint":"<0.6.0 (semantic)"},"fix":{"suggestedVersion":"0.6.0"}}],"artifact":{"id":"pkg:npm/adm-zip@0.5.12?package-id=12e43dec75aa588f","name":"adm-zip","version":"0.5.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adm-zip_project:adm-zip:0.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/adm-zip@0.5.12","upstreams":[]}},{"vulnerability":{"id":"GO-2026-4918","dataSource":"https://go.dev/cl/761581","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33814","epss":0.0084,"percentile":0.57882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-33814","cwe":"CWE-606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.53.0"],"state":"fixed","available":[{"version":"0.53.0","date":"2026-04-09","kind":"release"}]},"advisories":[],"risk":0.63},"relatedVulnerabilities":[{"id":"CVE-2026-33814","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33814","epss":0.0084,"percentile":0.57882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-33814","cwe":"CWE-606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<0.53.0 (go)"},"fix":{"suggestedVersion":"0.53.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-25h7-pfq9-p65f","dataSource":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","https://nvd.nist.gov/vuln/detail/CVE-2026-32141","https://github.com/WebReflection/flatted/pull/88","https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606"],"description":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32141","epss":0.00839,"percentile":0.57851,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32141","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-32141","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.4.0"],"state":"fixed","available":[{"version":"3.4.0","date":"2026-03-13","kind":"first-observed"}]},"advisories":[],"risk":0.62925},"relatedVulnerabilities":[{"id":"CVE-2026-32141","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","https://github.com/WebReflection/flatted/pull/88","https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-32141","https://bugzilla.redhat.com/show_bug.cgi?id=2447083","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json"],"description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32141","epss":0.00839,"percentile":0.57851,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32141","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-32141","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"flatted","version":"3.2.7"}},"found":{"vulnerabilityID":"GHSA-25h7-pfq9-p65f","versionConstraint":"<3.4.0 (semantic)"},"fix":{"suggestedVersion":"3.4.0"}}],"artifact":{"id":"pkg:npm/flatted@3.2.7?package-id=feb80a8ab596b6dd","name":"flatted","version":"3.2.7","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:flatted:flatted:3.2.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/flatted@3.2.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5wc-c3c7-36mc","dataSource":"https://github.com/advisories/GHSA-f5wc-c3c7-36mc","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39832","https://go.dev/cl/778642","https://go.dev/issue/79435","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5006","https://access.redhat.com/security/cve/CVE-2026-39832","https://bugzilla.redhat.com/show_bug.cgi?id=2480685","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910"],"description":"golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39832","epss":0.00683,"percentile":0.52549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39832","cwe":"CWE-502","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39832","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.6181150000000001},"relatedVulnerabilities":[{"id":"CVE-2026-39832","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39832","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/778640","https://go.dev/cl/778641","https://go.dev/issue/79435","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5006","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39832","https://bugzilla.redhat.com/show_bug.cgi?id=2480685","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json"],"description":"When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39832","epss":0.00683,"percentile":0.52549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39832","cwe":"CWE-502","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39832","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-f5wc-c3c7-36mc","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-vgwf-h737-ff37","dataSource":"https://github.com/advisories/GHSA-vgwf-h737-ff37","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39830","https://go.dev/cl/781640","https://go.dev/cl/781664","https://go.dev/issue/79564","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5017","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/security/cve/CVE-2026-39830","https://bugzilla.redhat.com/show_bug.cgi?id=2480684","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450"],"description":"golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39830","epss":0.00683,"percentile":0.52545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39830","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39830","cwe":"CWE-772","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.6181150000000001},"relatedVulnerabilities":[{"id":"CVE-2026-39830","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39830","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781640","https://go.dev/cl/781664","https://go.dev/issue/79564","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5017","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39830","https://bugzilla.redhat.com/show_bug.cgi?id=2480684","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json"],"description":"A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39830","epss":0.00683,"percentile":0.52545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39830","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39830","cwe":"CWE-772","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-vgwf-h737-ff37","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-jcxm-m3jx-f287","dataSource":"https://github.com/advisories/GHSA-jcxm-m3jx-f287","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287","https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26","https://www.cve.org/CVERecord?id=CVE-2022-25860","https://nvd.nist.gov/vuln/detail/CVE-2026-28291","https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d","https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0"],"description":"simple-git Affected by Command Execution via Option-Parsing Bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-28291","epss":0.00768,"percentile":0.5559,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-28291","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-28291","cwe":"CWE-78","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.32.0"],"state":"fixed","available":[{"version":"3.32.0","date":"2026-04-13","kind":"first-observed"}]},"advisories":[],"risk":0.5990400000000001},"relatedVulnerabilities":[{"id":"CVE-2026-28291","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28291","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/steveukx/git-js/blob/789c13ebabcf18ebe0b3a0c88ebb4037dede42e3/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts#L26","https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d","https://github.com/steveukx/git-js/releases/tag/simple-git%403.32.0","https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287","https://www.cve.org/CVERecord?id=CVE-2022-25860","https://access.redhat.com/security/cve/CVE-2026-28291","https://bugzilla.redhat.com/show_bug.cgi?id=2457930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28291.json"],"description":"simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for CVE-2022-25860, as Git's flexible option parsing allows numerous character combinations (e.g., -vu, -4u, -nu) to circumvent the regular-expression-based blocklist in the unsafe operations plugin. Due to the virtually infinite number of valid option variants that Git accepts, a complete blocklist-based mitigation may be infeasible without fully emulating Git's option parsing behavior. This issue has been fixed in version 3.32.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-28291","epss":0.00768,"percentile":0.5559,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-28291","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-28291","cwe":"CWE-78","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"simple-git","version":"3.24.0"}},"found":{"vulnerabilityID":"GHSA-jcxm-m3jx-f287","versionConstraint":"<3.32.0 (semantic)"},"fix":{"suggestedVersion":"3.32.0"}}],"artifact":{"id":"pkg:npm/simple-git@3.24.0?package-id=645a8534891a91f8","name":"simple-git","version":"3.24.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:simple-git_project:simple-git:3.24.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/simple-git@3.24.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxpw-j846-p89q","dataSource":"https://github.com/advisories/GHSA-vxpw-j846-p89q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q","https://nvd.nist.gov/vuln/detail/CVE-2026-12151","https://cna.openjsf.org/security-advisories.html"],"description":"undici WebSocket client vulnerable to denial of service via fragment count bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12151","epss":0.00789,"percentile":0.56236,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12151","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-12151","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-12151","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.27.0"],"state":"fixed","available":[{"version":"6.27.0","date":"2026-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.5917499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-12151","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12151","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:35841","https://access.redhat.com/errata/RHSA-2026:35842","https://access.redhat.com/errata/RHSA-2026:35891","https://access.redhat.com/errata/RHSA-2026:35892","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:38009","https://access.redhat.com/errata/RHSA-2026:38236","https://access.redhat.com/errata/RHSA-2026:39246","https://access.redhat.com/errata/RHSA-2026:39868","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41947","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:52399","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-12151","https://bugzilla.redhat.com/show_bug.cgi?id=2489980","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12151.json"],"description":"Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds:\nNo workaround is available. The fix must be applied through an upgrade.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12151","epss":0.00789,"percentile":0.56236,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12151","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-12151","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-12151","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-vxpw-j846-p89q","versionConstraint":"<6.27.0 (semantic)"},"fix":{"suggestedVersion":"6.27.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6612","dataSource":"https://go.dev/cl/847187","namespace":"govulndb:language:go","severity":"Critical","urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.56291},"relatedVulnerabilities":[{"id":"CVE-2026-78663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-3mfm-83xf-c92r","dataSource":"https://github.com/advisories/GHSA-3mfm-83xf-c92r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33938"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33938","epss":0.00721,"percentile":0.5398,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33938","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-917","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.56238},"relatedVulnerabilities":[{"id":"CVE-2026-33938","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33938","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33938","https://bugzilla.redhat.com/show_bug.cgi?id=2452525","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33938.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). The `compile()` method is  absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers  should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in  contexts where templates or context data can be influenced by untrusted input.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33938","epss":0.00721,"percentile":0.5398,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33938","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-917","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-3mfm-83xf-c92r","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhpv-hc6g-r9c6","dataSource":"https://github.com/advisories/GHSA-xhpv-hc6g-r9c6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33940"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33940","epss":0.00715,"percentile":0.53771,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.5577000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33940","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33940","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33940","https://bugzilla.redhat.com/show_bug.cgi?id=2452521","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33940.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). Without `compile()`,  the fallback compilation path in `invokePartial` is unreachable. Second, sanitize context data before rendering: Ensure no value in the context is a non-primitive  object that could be passed to a dynamic partial. Third, avoid dynamic partial lookups (`{{> (lookup ...)}}`) when context data is user-controlled.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33940","epss":0.00715,"percentile":0.53771,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-xhpv-hc6g-r9c6","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-rm3j-f69w-wqmq","dataSource":"https://github.com/advisories/GHSA-rm3j-f69w-wqmq","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39834","https://go.dev/cl/781663","https://go.dev/issue/79567","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5020"],"description":"golang.org/x/crypto vulnerable to infinite loop on large channel writes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39834","epss":0.00597,"percentile":0.48592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39834","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.540285},"relatedVulnerabilities":[{"id":"CVE-2026-39834","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39834","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/781663","https://go.dev/issue/79567","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5020"],"description":"When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39834","epss":0.00597,"percentile":0.48592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39834","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-rm3j-f69w-wqmq","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-v5mp-jgw5-2x6j","dataSource":"https://github.com/advisories/GHSA-v5mp-jgw5-2x6j","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j","https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44","https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463"],"description":"toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63376","epss":0.00683,"percentile":0.52561,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63376","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.2"],"state":"fixed","available":[{"version":"4.1.2","date":"2026-09-04","kind":"first-observed"}]},"advisories":[],"risk":0.5361549999999999},"relatedVulnerabilities":[{"id":"CVE-2026-63376","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63376","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44","https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j"],"description":"toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63376","epss":0.00683,"percentile":0.52561,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63376","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"toml","version":"2.3.6"}},"found":{"vulnerabilityID":"GHSA-v5mp-jgw5-2x6j","versionConstraint":"<4.1.2 (semantic)"},"fix":{"suggestedVersion":"4.1.2"}}],"artifact":{"id":"pkg:npm/toml@2.3.6?package-id=2424e5908514dce3","name":"toml","version":"2.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:toml:toml:2.3.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/toml@2.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-p8wg-vrv2-v86f","dataSource":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f","https://nvd.nist.gov/vuln/detail/CVE-2026-106445","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via Own Property Check Bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106445","epss":0.00589,"percentile":0.48165,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.53599},"relatedVulnerabilities":[{"id":"CVE-2026-106445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106445","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106445","epss":0.00589,"percentile":0.48165,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-p8wg-vrv2-v86f","versionConstraint":">=3.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-x527-x647-q7gg","dataSource":"https://github.com/advisories/GHSA-x527-x647-q7gg","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-45337","https://nvd.nist.gov/vuln/detail/CVE-2026-46595","https://go.dev/cl/781642","https://go.dev/issue/79570","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5023","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/security/cve/CVE-2026-46595","https://bugzilla.redhat.com/show_bug.cgi?id=2480689","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40945"],"description":"golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46595","epss":0.00556,"percentile":0.46417,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46595","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-46595","cwe":"CWE-303","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.5281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-46595","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46595","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781642","https://go.dev/issue/79570","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5023","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-46595","https://bugzilla.redhat.com/show_bug.cgi?id=2480689","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json"],"description":"Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46595","epss":0.00556,"percentile":0.46417,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46595","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-46595","cwe":"CWE-303","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-x527-x647-q7gg","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-8qff-qr5q-5pr8","dataSource":"https://github.com/advisories/GHSA-8qff-qr5q-5pr8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-8qff-qr5q-5pr8","https://nvd.nist.gov/vuln/detail/CVE-2025-47934","https://github.com/openpgpjs/openpgpjs/commit/43f5f4e2bd67d0514d06acc60b6ee571a049c229","https://github.com/openpgpjs/openpgpjs/commit/843a69d0adbdec0f87af09f9000a9223e6614e5c","https://github.com/openpgpjs/openpgpjs/commit/bd54e8535ca29b3bef58a8c02296892e408be356","https://github.com/openpgpjs/openpgpjs/releases/tag/v5.11.3","https://github.com/openpgpjs/openpgpjs/releases/tag/v6.1.1"],"description":"OpenPGP.js's message signature verification can be spoofed","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47934","epss":0.00645,"percentile":0.5094,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-47934","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.11.3"],"state":"fixed","available":[{"version":"5.11.3","date":"2025-05-22","kind":"first-observed"}]},"advisories":[],"risk":0.52245},"relatedVulnerabilities":[{"id":"CVE-2025-47934","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47934","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openpgpjs/openpgpjs/commit/43f5f4e2bd67d0514d06acc60b6ee571a049c229","https://github.com/openpgpjs/openpgpjs/commit/bd54e8535ca29b3bef58a8c02296892e408be356","https://github.com/openpgpjs/openpgpjs/releases/tag/v5.11.3","https://github.com/openpgpjs/openpgpjs/releases/tag/v6.1.1","https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-8qff-qr5q-5pr8"],"description":"OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either `openpgp.verify` or `openpgp.decrypt`, causing these functions to return a valid signature verification result while returning data that was not actually signed. This flaw allows signature verifications of inline (non-detached) signed messages (using `openpgp.verify`) and signed-and-encrypted messages (using `openpgp.decrypt` with `verificationKeys`) to be spoofed, since both functions return extracted data that may not match the data that was originally signed. Detached signature verifications are not affected, as no signed data is returned in that case. In order to spoof a message, the attacker needs a single valid message signature (inline or detached) as well as the plaintext data that was legitimately signed, and can then construct an inline-signed message or signed-and-encrypted message with any data of the attacker's choice, which will appear as legitimately signed by affected versions of OpenPGP.js. In other words, any inline-signed message can be modified to return any other data (while still indicating that the signature was valid), and the same is true for signed+encrypted messages if the attacker can obtain a valid signature and encrypt a new message (of the attacker's choice) together with that signature. The issue has been patched in versions 5.11.3 and 6.1.1. Some workarounds are available. When verifying inline-signed messages, extract the message and signature(s) from the message returned by `openpgp.readMessage`, and verify the(/each) signature as a detached signature by passing the signature and a new message containing only the data (created using `openpgp.createMessage`) to `openpgp.verify`.  When decrypting and verifying signed+encrypted messages, decrypt and verify the message in two steps, by first calling `openpgp.decrypt` without `verificationKeys`, and then passing the returned signature(s) and a new message containing the decrypted data (created using `openpgp.createMessage`) to `openpgp.verify`.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47934","epss":0.00645,"percentile":0.5094,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-47934","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"openpgp","version":"5.11.1"}},"found":{"vulnerabilityID":"GHSA-8qff-qr5q-5pr8","versionConstraint":">=5.0.1,<=5.11.2 (semantic)"},"fix":{"suggestedVersion":"5.11.3"}}],"artifact":{"id":"pkg:npm/openpgp@5.11.1?package-id=2482e2e3ad61c3c6","name":"openpgp","version":"5.11.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openpgp:openpgp:5.11.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/openpgp@5.11.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2943-5xfg-gq5f","dataSource":"https://github.com/advisories/GHSA-2943-5xfg-gq5f","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f","https://github.com/jsonata-js/jsonata/pull/799","https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2","https://github.com/jsonata-js/jsonata/commit/c41ef185136a7b96ca1049c7745a7503b82193de","https://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1"],"description":"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77414","epss":0.0057,"percentile":0.47191,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77414","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.2.1"],"state":"fixed","available":[{"version":"2.2.1","date":"2026-08-22","kind":"first-observed"}]},"advisories":[],"risk":0.5215500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-77414","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77414","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2","https://github.com/jsonata-js/jsonata/pull/799","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1","https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f"],"description":"JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77414","epss":0.0057,"percentile":0.47191,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77414","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonata","version":"2.0.5"}},"found":{"vulnerabilityID":"GHSA-2943-5xfg-gq5f","versionConstraint":">=2.0.0,<2.2.1 (semantic)"},"fix":{"suggestedVersion":"2.2.1"}}],"artifact":{"id":"pkg:npm/jsonata@2.0.5?package-id=25fabe95ef4fd484","name":"jsonata","version":"2.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:jsonata:jsonata:2.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/jsonata@2.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v4p-qf9q-27wj","dataSource":"https://github.com/advisories/GHSA-2v4p-qf9q-27wj","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://nvd.nist.gov/vuln/detail/CVE-2026-84445"],"description":"gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.82.2"],"state":"fixed","available":[{"version":"1.82.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.51921},"relatedVulnerabilities":[{"id":"CVE-2026-84445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.69.4"}},"found":{"vulnerabilityID":"GHSA-2v4p-qf9q-27wj","versionConstraint":"<1.82.2 (go)"},"fix":{"suggestedVersion":"1.82.2"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.69.4?package-id=1f850ee01658c705","name":"google.golang.org/grpc","version":"v1.69.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.69.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.69.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A="}}},{"vulnerability":{"id":"GHSA-86vw-mfpg-wwv9","dataSource":"https://github.com/advisories/GHSA-86vw-mfpg-wwv9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/jsonata-js/jsonata/security/advisories/GHSA-86vw-mfpg-wwv9","https://github.com/jsonata-js/jsonata/pull/782","https://github.com/jsonata-js/jsonata/pull/793","https://github.com/jsonata-js/jsonata/commit/80ba95d170f74e3f20f4f36b8b77d8c85cea7686","https://github.com/jsonata-js/jsonata/commit/d6ffc17cb16a8e53c222205bd274624e919cce0b","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0","https://nvd.nist.gov/vuln/detail/CVE-2026-52746","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.9"],"description":"jsonata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-52746","epss":0.00689,"percentile":0.52776,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-52746","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.2.0"],"state":"fixed","available":[{"version":"2.2.0","date":"2026-07-03","kind":"first-observed"}]},"advisories":[],"risk":0.51675},"relatedVulnerabilities":[{"id":"CVE-2026-52746","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52746","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jsonata-js/jsonata/commit/80ba95d170f74e3f20f4f36b8b77d8c85cea7686","https://github.com/jsonata-js/jsonata/commit/d6ffc17cb16a8e53c222205bd274624e919cce0b","https://github.com/jsonata-js/jsonata/pull/782","https://github.com/jsonata-js/jsonata/pull/793","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.9","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0","https://github.com/jsonata-js/jsonata/security/advisories/GHSA-86vw-mfpg-wwv9"],"description":"JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-52746","epss":0.00689,"percentile":0.52776,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-52746","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonata","version":"2.0.5"}},"found":{"vulnerabilityID":"GHSA-86vw-mfpg-wwv9","versionConstraint":">=2.0.0,<2.2.0 (semantic)"},"fix":{"suggestedVersion":"2.2.0"}}],"artifact":{"id":"pkg:npm/jsonata@2.0.5?package-id=25fabe95ef4fd484","name":"jsonata","version":"2.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:jsonata:jsonata:2.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/jsonata@2.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-23hp-3jrh-7fpw","dataSource":"https://github.com/advisories/GHSA-23hp-3jrh-7fpw","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","https://nvd.nist.gov/vuln/detail/CVE-2026-59873","https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19"],"description":"node-tar: Decompression/parse DoS via unlimited input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.19"],"state":"fixed","available":[{"version":"7.5.19","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.5048849999999999},"relatedVulnerabilities":[{"id":"CVE-2026-59873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19","https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-23hp-3jrh-7fpw","versionConstraint":"<=7.5.18 (semantic)"},"fix":{"suggestedVersion":"7.5.19"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GO-2025-4116","dataSource":"https://go.dev/cl/700295","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/75178","https://github.com/advisories/GHSA-56w8-48fp-6mgv"],"description":"SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47913","epss":0.00668,"percentile":0.51915,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-47913","cwe":"CWE-617","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.43.0"],"state":"fixed","available":[{"version":"0.43.0","date":"2025-10-08","kind":"release"}]},"advisories":[],"risk":0.5010000000000001},"relatedVulnerabilities":[{"id":"CVE-2025-47913","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47913","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/advisories/GHSA-56w8-48fp-6mgv","https://go.dev/cl/700295","https://go.dev/issue/75178","https://pkg.go.dev/vuln/GO-2025-4116"],"description":"SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47913","epss":0.00668,"percentile":0.51915,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-47913","cwe":"CWE-617","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GO-2025-4116","versionConstraint":"<0.43.0 (go)"},"fix":{"suggestedVersion":"0.43.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.21.3"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.21.3?package-id=33a96bd7715b13ff","name":"browserslist","version":"4.21.3","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.21.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.21.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-vp52-pcj8-j9qc","dataSource":"https://github.com/advisories/GHSA-vp52-pcj8-j9qc","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://nvd.nist.gov/vuln/detail/CVE-2026-84304","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"description":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84304","epss":0.00609,"percentile":0.49155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.83.1"],"state":"fixed","available":[{"version":"1.83.1","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49328999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-84304","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84304","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84304","epss":0.00609,"percentile":0.49155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.69.4"}},"found":{"vulnerabilityID":"GHSA-vp52-pcj8-j9qc","versionConstraint":"<=1.83.0 (go)"},"fix":{"suggestedVersion":"1.83.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.69.4?package-id=1f850ee01658c705","name":"google.golang.org/grpc","version":"v1.69.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.69.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.69.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A="}}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.21.3"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.21.3?package-id=33a96bd7715b13ff","name":"browserslist","version":"4.21.3","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.21.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.21.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-78h2-9frx-2jm8","dataSource":"https://github.com/advisories/GHSA-78h2-9frx-2jm8","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","https://nvd.nist.gov/vuln/detail/CVE-2026-34986"],"description":"Go JOSE Panics in JWE decryption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34986","epss":0.00651,"percentile":0.51215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34986","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34986","cwe":"CWE-131","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.1.4"],"state":"fixed","available":[{"version":"4.1.4","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.48824999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-34986","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10130","https://access.redhat.com/errata/RHSA-2026:10135","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:11070","https://access.redhat.com/errata/RHSA-2026:11217","https://access.redhat.com/errata/RHSA-2026:11512","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12116","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17121","https://access.redhat.com/errata/RHSA-2026:17123","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17458","https://access.redhat.com/errata/RHSA-2026:17459","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18584","https://access.redhat.com/errata/RHSA-2026:18585","https://access.redhat.com/errata/RHSA-2026:19017","https://access.redhat.com/errata/RHSA-2026:19099","https://access.redhat.com/errata/RHSA-2026:19108","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19173","https://access.redhat.com/errata/RHSA-2026:19186","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:20034","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21703","https://access.redhat.com/errata/RHSA-2026:21709","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21931","https://access.redhat.com/errata/RHSA-2026:21932","https://access.redhat.com/errata/RHSA-2026:22258","https://access.redhat.com/errata/RHSA-2026:22260","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23241","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24471","https://access.redhat.com/errata/RHSA-2026:24475","https://access.redhat.com/errata/RHSA-2026:24477","https://access.redhat.com/errata/RHSA-2026:24479","https://access.redhat.com/errata/RHSA-2026:24482","https://access.redhat.com/errata/RHSA-2026:24484","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25187","https://access.redhat.com/errata/RHSA-2026:25194","https://access.redhat.com/errata/RHSA-2026:25206","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:26054","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27001","https://access.redhat.com/errata/RHSA-2026:27004","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27856","https://access.redhat.com/errata/RHSA-2026:28198","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:32991","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34099","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34794","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48085","https://access.redhat.com/errata/RHSA-2026:48676","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56968","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60444","https://access.redhat.com/errata/RHSA-2026:60449","https://access.redhat.com/errata/RHSA-2026:60452","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62548","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65906","https://access.redhat.com/errata/RHSA-2026:66385","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9388","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/security/cve/CVE-2026-34986","https://bugzilla.redhat.com/show_bug.cgi?id=2455470","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34986.json"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34986","epss":0.00651,"percentile":0.51215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34986","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34986","cwe":"CWE-131","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.0.5"}},"found":{"vulnerabilityID":"GHSA-78h2-9frx-2jm8","versionConstraint":"<4.1.4 (go)"},"fix":{"suggestedVersion":"4.1.4"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5?package-id=f213d0688efe1976","name":"github.com/go-jose/go-jose/v4","version":"v4.0.5","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE="}}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=1482748c5e5e48e1","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=65495197b2cc853c","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=e23bb758fbfbc9b6","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=a4ce8262f03be3fe","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=1482748c5e5e48e1","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=65495197b2cc853c","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.3"],"state":"fixed","available":[{"version":"2.1.3","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":">=2.0.0,<2.1.3 (semantic)"},"fix":{"suggestedVersion":"2.1.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=e23bb758fbfbc9b6","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.3"],"state":"fixed","available":[{"version":"2.1.3","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":">=2.0.0,<2.1.3 (semantic)"},"fix":{"suggestedVersion":"2.1.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=a4ce8262f03be3fe","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-m7jm-9gc2-mpf2","dataSource":"https://github.com/advisories/GHSA-m7jm-9gc2-mpf2","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2","https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e","https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5","https://nvd.nist.gov/vuln/detail/CVE-2026-25896"],"description":"fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","metrics":{"baseScore":9.3,"exploitabilityScore":3.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25896","epss":0.00527,"percentile":0.4469,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25896","cwe":"CWE-185","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-25896","cwe":"CWE-79","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.5.4"],"state":"fixed","available":[{"version":"4.5.4","date":"2026-02-28","kind":"first-observed"}]},"advisories":[],"risk":0.48220500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-25896","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25896","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e","https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:6174","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7110","https://access.redhat.com/errata/RHSA-2026:7128","https://access.redhat.com/security/cve/CVE-2026-25896","https://bugzilla.redhat.com/show_bug.cgi?id=2441501","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25896.json","https://github.com/naturalintelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e","https://github.com/naturalintelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69"],"description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (&lt;, &gt;, &amp;, &quot;, &apos;) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","metrics":{"baseScore":7.1,"exploitabilityScore":2.9,"impactScore":3.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","metrics":{"baseScore":9.3,"exploitabilityScore":3.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25896","epss":0.00527,"percentile":0.4469,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25896","cwe":"CWE-185","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-25896","cwe":"CWE-79","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-xml-parser","version":"4.2.5"}},"found":{"vulnerabilityID":"GHSA-m7jm-9gc2-mpf2","versionConstraint":">=4.1.3,<4.5.4 (semantic)"},"fix":{"suggestedVersion":"4.5.4"}}],"artifact":{"id":"pkg:npm/fast-xml-parser@4.2.5?package-id=7b31b6b780a1a92a","name":"fast-xml-parser","version":"4.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:naturalintelligence:fast-xml-parser:4.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/fast-xml-parser@4.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-01-29","kind":"first-observed"}]},"advisories":[],"risk":0.47728},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-24842","https://bugzilla.redhat.com/show_bug.cgi?id=2433645","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6603","dataSource":"https://go.dev/cl/847185","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-78659","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-9cx6-37pm-9jff","dataSource":"https://github.com/advisories/GHSA-9cx6-37pm-9jff","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33939"],"description":"Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33939","epss":0.00627,"percentile":0.50068,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33939","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33939","cwe":"CWE-248","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-33939","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33939","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33939","https://bugzilla.redhat.com/show_bug.cgi?id=2452508","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33939.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, \"n\")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing  decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled  templates; do not call `compile()` at request time.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33939","epss":0.00627,"percentile":0.50068,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33939","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33939","cwe":"CWE-248","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-9cx6-37pm-9jff","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=26a8e8ef1a39a8a8","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=a7b0933ed4650c5a","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.6"],"state":"fixed","available":[{"version":"9.0.6","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":">=9.0.0,<9.0.6 (semantic)"},"fix":{"suggestedVersion":"9.0.6"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.2?package-id=8dac92e72432bd99","name":"minimatch","version":"9.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.6"],"state":"fixed","available":[{"version":"9.0.6","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.3"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":">=9.0.0,<9.0.6 (semantic)"},"fix":{"suggestedVersion":"9.0.6"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.3?package-id=42f60793ba1d6cbb","name":"minimatch","version":"9.0.3","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.6"],"state":"fixed","available":[{"version":"9.0.6","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":">=9.0.0,<9.0.6 (semantic)"},"fix":{"suggestedVersion":"9.0.6"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=ec7fd1ea758408dd","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.6"],"state":"fixed","available":[{"version":"9.0.6","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":">=9.0.0,<9.0.6 (semantic)"},"fix":{"suggestedVersion":"9.0.6"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=b7de08b769c18701","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6611","dataSource":"https://go.dev/cl/847186","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.46049999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-78669","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-82x6-q7mm-w9cf","dataSource":"https://github.com/advisories/GHSA-82x6-q7mm-w9cf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf","https://github.com/BinaryMuse/toml-node/pull/72","https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f"],"description":"toml-node: Uncontrolled Recursion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77465","epss":0.00609,"percentile":0.49181,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77465","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-09-04","kind":"first-observed"}]},"advisories":[],"risk":0.45675000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-77465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77465","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f","https://github.com/BinaryMuse/toml-node/pull/72","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf"],"description":"toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77465","epss":0.00609,"percentile":0.49181,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77465","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"toml","version":"2.3.6"}},"found":{"vulnerabilityID":"GHSA-82x6-q7mm-w9cf","versionConstraint":"<4.2.0 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:npm/toml@2.3.6?package-id=2424e5908514dce3","name":"toml","version":"2.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:toml:toml:2.3.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/toml@2.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-7q85-xj36-vmfc","dataSource":"https://github.com/advisories/GHSA-7q85-xj36-vmfc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc","https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"],"description":"adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77301","epss":0.00609,"percentile":0.49177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77301","cwe":"CWE-789","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.6.1"],"state":"fixed","available":[{"version":"0.6.1","date":"2026-09-19","kind":"first-observed"}]},"advisories":[],"risk":0.45675000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-77301","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77301","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc"],"description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-77301","epss":0.00609,"percentile":0.49177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-77301","cwe":"CWE-789","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"adm-zip","version":"0.5.12"}},"found":{"vulnerabilityID":"GHSA-7q85-xj36-vmfc","versionConstraint":"<0.6.1 (semantic)"},"fix":{"suggestedVersion":"0.6.1"}}],"artifact":{"id":"pkg:npm/adm-zip@0.5.12?package-id=12e43dec75aa588f","name":"adm-zip","version":"0.5.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adm-zip_project:adm-zip:0.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/adm-zip@0.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-858h-whjf-mvg5","dataSource":"https://github.com/advisories/GHSA-858h-whjf-mvg5","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5","https://nvd.nist.gov/vuln/detail/CVE-2026-102827","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0"],"description":"simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102827","epss":0.00576,"percentile":0.47546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102827","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102827","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.0"],"state":"fixed","available":[{"version":"4.0.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.44928000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-102827","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102827","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0","https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5"],"description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous long-option abbreviations. Attacker-influenced push arguments such as abbreviated --receive-pack or --exec forms can therefore bypass detectVulnerableFlags, reach git push against a local or file remote or an attacker-influenced receive-pack target, and cause Git to invoke an attacker-selected command in consumers that expose those arguments. The clone-side abbreviation handling does not protect the push path. This issue is fixed in 4.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102827","epss":0.00576,"percentile":0.47546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102827","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102827","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"simple-git","version":"3.24.0"}},"found":{"vulnerabilityID":"GHSA-858h-whjf-mvg5","versionConstraint":"<=3.36.0 (semantic)"},"fix":{"suggestedVersion":"4.0.0"}}],"artifact":{"id":"pkg:npm/simple-git@3.24.0?package-id=645a8534891a91f8","name":"simple-git","version":"3.24.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:simple-git_project:simple-git:3.24.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/simple-git@3.24.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8gc5-j5rx-235r","dataSource":"https://github.com/advisories/GHSA-8gc5-j5rx-235r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r","https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6","https://nvd.nist.gov/vuln/detail/CVE-2026-33036","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v4.5.5"],"description":"fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33036","epss":0.00599,"percentile":0.48674,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33036","cwe":"CWE-776","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.5.5"],"state":"fixed","available":[{"version":"4.5.5","date":"2026-03-25","kind":"first-observed"}]},"advisories":[],"risk":0.44925},"relatedVulnerabilities":[{"id":"CVE-2026-33036","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33036","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.6","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r"],"description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like &#65; can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33036","epss":0.00599,"percentile":0.48674,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33036","cwe":"CWE-776","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-xml-parser","version":"4.2.5"}},"found":{"vulnerabilityID":"GHSA-8gc5-j5rx-235r","versionConstraint":">=4.0.0-beta.3,<4.5.5 (semantic)"},"fix":{"suggestedVersion":"4.5.5"}}],"artifact":{"id":"pkg:npm/fast-xml-parser@4.2.5?package-id=7b31b6b780a1a92a","name":"fast-xml-parser","version":"4.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:naturalintelligence:fast-xml-parser:4.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/fast-xml-parser@4.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-vj76-c3g6-qr5v","dataSource":"https://github.com/advisories/GHSA-vj76-c3g6-qr5v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","https://nvd.nist.gov/vuln/detail/CVE-2025-59343","https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"],"description":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00553,"percentile":0.46203,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-59343","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-59343","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2025-09-27","kind":"first-observed"}]},"advisories":[],"risk":0.44792999999999994},"relatedVulnerabilities":[{"id":"CVE-2025-59343","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59343","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"],"description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00553,"percentile":0.46203,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-59343","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-59343","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar-fs","version":"2.1.3"}},"found":{"vulnerabilityID":"GHSA-vj76-c3g6-qr5v","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"pkg:npm/tar-fs@2.1.3?package-id=c511d79a2030ea53","name":"tar-fs","version":"2.1.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:tar-fs:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar_fs:2.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/tar-fs@2.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-r7fv-28h4-cvq7","dataSource":"https://github.com/advisories/GHSA-r7fv-28h4-cvq7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7","https://nvd.nist.gov/vuln/detail/CVE-2026-111759","https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2"],"description":"markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111759","epss":0.00591,"percentile":0.48256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111759","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.2"],"state":"fixed","available":[{"version":"14.3.2","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.4432500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-111759","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111759","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"],"description":"markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111759","epss":0.00591,"percentile":0.48256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111759","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.0"}},"found":{"vulnerabilityID":"GHSA-r7fv-28h4-cvq7","versionConstraint":"<14.3.2 (semantic)"},"fix":{"suggestedVersion":"14.3.2"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.0?package-id=153988745b47afba","name":"markdown-it","version":"14.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=3.0.0,<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=c9ca33406d6c0fb3","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.0"],"state":"fixed","available":[{"version":"4.3.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=4.0.0,<4.3.0 (semantic)"},"fix":{"suggestedVersion":"4.3.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=c6c6a08d466512f1","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.0"],"state":"fixed","available":[{"version":"4.3.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=4.0.0,<4.3.0 (semantic)"},"fix":{"suggestedVersion":"4.3.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0bee311501151095","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.0"],"state":"fixed","available":[{"version":"4.3.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=4.0.0,<4.3.0 (semantic)"},"fix":{"suggestedVersion":"4.3.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0027c1be54e9cf42","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-89gr-r52h-f8rx","dataSource":"https://github.com/advisories/GHSA-89gr-r52h-f8rx","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39831","https://go.dev/cl/781662","https://go.dev/issue/79566","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5019"],"description":"golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39831","epss":0.00478,"percentile":0.41315,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39831","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.43259000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-39831","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39831","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/781662","https://go.dev/issue/79566","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5019"],"description":"The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39831","epss":0.00478,"percentile":0.41315,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39831","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-89gr-r52h-f8rx","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=26a8e8ef1a39a8a8","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=a7b0933ed4650c5a","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.2?package-id=8dac92e72432bd99","name":"minimatch","version":"9.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.3"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.3?package-id=42f60793ba1d6cbb","name":"minimatch","version":"9.0.3","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=b7de08b769c18701","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=ec7fd1ea758408dd","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-259r-337f-4rfw","dataSource":"https://github.com/advisories/GHSA-259r-337f-4rfw","namespace":"github:language:go","severity":"High","urls":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63209","https://github.com/klauspost/compress/pull/1163","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"description":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.18.7"],"state":"fixed","available":[{"version":"1.18.7","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.42900000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-63209","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7","https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"],"description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/klauspost/compress","version":"v1.17.11"}},"found":{"vulnerabilityID":"GHSA-259r-337f-4rfw","versionConstraint":"<=1.18.6 (go)"},"fix":{"suggestedVersion":"1.18.7"}}],"artifact":{"id":"pkg:golang/github.com/klauspost/compress@v1.17.11?package-id=cb0f03226c6b4251","name":"github.com/klauspost/compress","version":"v1.17.11","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:klauspost:compress:v1.17.11:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/klauspost/compress@v1.17.11","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc="}}},{"vulnerability":{"id":"GHSA-jppx-rxg9-jmrx","dataSource":"https://github.com/advisories/GHSA-jppx-rxg9-jmrx","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39833","https://go.dev/cl/778640","https://go.dev/cl/778641","https://go.dev/issue/79436","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5005"],"description":"golang.org/x/crypto doesn't enforce invoking key constraints","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39833","epss":0.00469,"percentile":0.40593,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39833","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.424445},"relatedVulnerabilities":[{"id":"CVE-2026-39833","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39833","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/778642","https://go.dev/issue/79436","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5005"],"description":"The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39833","epss":0.00469,"percentile":0.40593,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39833","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-jppx-rxg9-jmrx","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-45rx-2jwx-cxfr","dataSource":"https://github.com/advisories/GHSA-45rx-2jwx-cxfr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr","https://nvd.nist.gov/vuln/detail/CVE-2026-59892","https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88","https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0"],"description":"OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59892","epss":0.00557,"percentile":0.46471,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59892","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.9.0"],"state":"fixed","available":[{"version":"2.9.0","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.41775000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-59892","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59892","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88","https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0","https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"],"description":"OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59892","epss":0.00557,"percentile":0.46471,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59892","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@opentelemetry/propagator-jaeger","version":"1.24.1"}},"found":{"vulnerabilityID":"GHSA-45rx-2jwx-cxfr","versionConstraint":"<2.9.0 (semantic)"},"fix":{"suggestedVersion":"2.9.0"}}],"artifact":{"id":"pkg:npm/%40opentelemetry/propagator-jaeger@1.24.1?package-id=30e6500160158684","name":"@opentelemetry/propagator-jaeger","version":"1.24.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@opentelemetry\\/propagator-jaeger:\\@opentelemetry\\/propagator-jaeger:1.24.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/propagator-jaeger:\\@opentelemetry\\/propagator_jaeger:1.24.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/propagator_jaeger:\\@opentelemetry\\/propagator-jaeger:1.24.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/propagator_jaeger:\\@opentelemetry\\/propagator_jaeger:1.24.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/propagator:\\@opentelemetry\\/propagator-jaeger:1.24.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@opentelemetry\\/propagator:\\@opentelemetry\\/propagator_jaeger:1.24.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40opentelemetry/propagator-jaeger@1.24.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-jmr9-qjv8-65gv","dataSource":"https://github.com/advisories/GHSA-jmr9-qjv8-65gv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","https://nvd.nist.gov/vuln/detail/CVE-2026-56876","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","https://www.cve.org/CVERecord?id=CVE-2026-56876"],"description":"extract-zip unvalidated symlink path traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56876","epss":0.00526,"percentile":0.44573,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56876","cwe":"CWE-22","source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"},{"cve":"CVE-2026-56876","cwe":"CWE-61","source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.416855},"relatedVulnerabilities":[{"id":"CVE-2026-56876","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56876","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","https://www.cve.org/CVERecord?id=CVE-2026-56876"],"description":"extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.","cvss":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"vendorMetadata":{}},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56876","epss":0.00526,"percentile":0.44573,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56876","cwe":"CWE-22","source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"},{"cve":"CVE-2026-56876","cwe":"CWE-61","source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"extract-zip","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-jmr9-qjv8-65gv","versionConstraint":"<=2.0.1 (semantic)"}}],"artifact":{"id":"pkg:npm/extract-zip@2.0.1?package-id=a9c4798828e0b148","name":"extract-zip","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:max-mapper:extract-zip:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/extract-zip@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-gfr2-rv44-r23c","dataSource":"https://github.com/advisories/GHSA-gfr2-rv44-r23c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c","https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"description":"markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111758","epss":0.0055,"percentile":0.46043,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111758","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111758","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.3"],"state":"fixed","available":[{"version":"14.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.41250000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-111758","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111758","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c"],"description":"markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111758","epss":0.0055,"percentile":0.46043,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111758","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111758","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.0"}},"found":{"vulnerabilityID":"GHSA-gfr2-rv44-r23c","versionConstraint":">=14.1.0,<14.3.3 (semantic)"},"fix":{"suggestedVersion":"14.3.3"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.0?package-id=153988745b47afba","name":"markdown-it","version":"14.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5942","dataSource":"https://go.dev/cl/786345","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46600","epss":0.00549,"percentile":0.45997,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46600","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-06-09","kind":"release"}]},"advisories":[],"risk":0.41174999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-46600","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46600","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/786345","https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5942"],"description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46600","epss":0.00549,"percentile":0.45997,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46600","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-5942","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.2"],"state":"fixed","available":[{"version":"3.15.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=3.0.0,<3.15.2 (semantic)"},"fix":{"suggestedVersion":"3.15.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=c9ca33406d6c0fb3","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=4.0.0,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0027c1be54e9cf42","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=4.0.0,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=c6c6a08d466512f1","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=4.0.0,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0bee311501151095","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c54-x2g4-v92j","dataSource":"https://github.com/advisories/GHSA-9c54-x2g4-v92j","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"],"description":"Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49835","epss":0.00744,"percentile":0.54768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49835","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.40548000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-49835","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49835","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5","https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0","https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"],"description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49835","epss":0.00744,"percentile":0.54768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49835","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/timestamp-authority","version":"v1.2.2"}},"found":{"vulnerabilityID":"GHSA-9c54-x2g4-v92j","versionConstraint":"<=1.2.9 (go)"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2?package-id=f89b0bf61be9ed87","name":"github.com/sigstore/timestamp-authority","version":"v1.2.2","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:timestamp-authority:v1.2.2:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:timestamp_authority:v1.2.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4qyutnCQqJ0apMewFyx+3t7Tws00JQ/JonBiu3QvLE="}}},{"vulnerability":{"id":"GHSA-r292-9mhp-454m","dataSource":"https://github.com/advisories/GHSA-r292-9mhp-454m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/releases/tag/v7.5.21","https://nvd.nist.gov/vuln/detail/CVE-2026-73566"],"description":"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.21"],"state":"fixed","available":[{"version":"7.5.21","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.39825},"relatedVulnerabilities":[{"id":"CVE-2026-73566","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-r292-9mhp-454m","versionConstraint":"<=7.5.20 (semantic)"},"fix":{"suggestedVersion":"7.5.21"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-p436-gjf2-799p","dataSource":"https://github.com/advisories/GHSA-p436-gjf2-799p","namespace":"github:language:go","severity":"High","urls":["https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p","https://nvd.nist.gov/vuln/detail/CVE-2025-15558","https://github.com/docker/cli/pull/6713","https://github.com/docker/compose/pull/12300","https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa","https://docs.docker.com/desktop/release-notes","https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304"],"description":"Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15558","epss":0.00549,"percentile":0.45994,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15558","cwe":"CWE-427","source":"security@docker.com","type":"Secondary"},{"cve":"CVE-2025-15558","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["29.2.0"],"state":"fixed","available":[{"version":"29.2.0","date":"2026-03-05","kind":"first-observed"}]},"advisories":[],"risk":0.398025},"relatedVulnerabilities":[{"id":"CVE-2025-15558","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15558","namespace":"nvd:cpe","severity":"High","urls":["https://docs.docker.com/desktop/release-notes/","https://github.com/docker/cli/pull/6713","https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/","https://access.redhat.com/security/cve/CVE-2025-15558","https://bugzilla.redhat.com/show_bug.cgi?id=2444574","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15558.json"],"description":"Docker CLI for Windows searches for plugin binaries in C:\\ProgramData\\Docker\\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.\n\nThis issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the  github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose.\n\nThis issue does not impact non-Windows binaries, and projects not using the plugin-manager code.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"exploitabilityScore":2.1,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"exploitabilityScore":1.4,"impactScore":5.9},"vendorMetadata":{}},{"source":"security@docker.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15558","epss":0.00549,"percentile":0.45994,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15558","cwe":"CWE-427","source":"security@docker.com","type":"Secondary"},{"cve":"CVE-2025-15558","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/cli","version":"v27.5.0+incompatible"}},"found":{"vulnerabilityID":"GHSA-p436-gjf2-799p","versionConstraint":">=19.03.0,<29.2.0 (go)"},"fix":{"suggestedVersion":"29.2.0"}}],"artifact":{"id":"pkg:golang/github.com/docker/cli@v27.5.0%2Bincompatible?package-id=0447f5eb3d702808","name":"github.com/docker/cli","version":"v27.5.0+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:cli:v27.5.0\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/cli@v27.5.0%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:aMphQkcGtpHixwwhAXJT1rrK/detk2JIvDaFkLctbGM="}}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=a7b0933ed4650c5a","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=26a8e8ef1a39a8a8","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.2?package-id=8dac92e72432bd99","name":"minimatch","version":"9.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.3"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.3?package-id=42f60793ba1d6cbb","name":"minimatch","version":"9.0.3","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=b7de08b769c18701","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=ec7fd1ea758408dd","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-38c4-r59v-3vqw","dataSource":"https://github.com/advisories/GHSA-38c4-r59v-3vqw","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-2327","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs#L33"],"description":"markdown-it is has a Regular Expression Denial of Service (ReDoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2327","epss":0.00739,"percentile":0.54576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"}],"fix":{"versions":["14.1.1"],"state":"fixed","available":[{"version":"14.1.1","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.38428},"relatedVulnerabilities":[{"id":"CVE-2026-2327","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2327","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917","https://github.com/markdown-it/markdown-it/blob/14.1.0/lib/rules_inline/linkify.mjs%23L33","https://github.com/markdown-it/markdown-it/commit/4b4bbcae5e0990a5b172378e507b33a59012ed26","https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750"],"description":"Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2327","epss":0.00739,"percentile":0.54576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2327","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.0"}},"found":{"vulnerabilityID":"GHSA-38c4-r59v-3vqw","versionConstraint":">=13.0.0,<14.1.1 (semantic)"},"fix":{"suggestedVersion":"14.1.1"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.0?package-id=153988745b47afba","name":"markdown-it","version":"14.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4qx8-w7c3-pj3p","dataSource":"https://github.com/advisories/GHSA-4qx8-w7c3-pj3p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p","https://nvd.nist.gov/vuln/detail/CVE-2026-114141","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"description":"toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114141","epss":0.00473,"percentile":0.40898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114141","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.38312999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-114141","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114141","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-4qx8-w7c3-pj3p"],"description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct [[name]] paths are not pruned, so a document with many such headers causes quadratic synchronous work and can block the Node.js event loop, denying service to other operations in the process. This issue is fixed in version 5.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114141","epss":0.00473,"percentile":0.40898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114141","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"toml","version":"2.3.6"}},"found":{"vulnerabilityID":"GHSA-4qx8-w7c3-pj3p","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/toml@2.3.6?package-id=2424e5908514dce3","name":"toml","version":"2.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:toml:toml:2.3.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/toml@2.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-9j65-hcg3-gc64","dataSource":"https://github.com/advisories/GHSA-9j65-hcg3-gc64","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64","https://nvd.nist.gov/vuln/detail/CVE-2026-114143","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"description":"toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114143","epss":0.00473,"percentile":0.40898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114143","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.38312999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-114143","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114143","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9j65-hcg3-gc64"],"description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign(), deepRef(), and setNestedKey(). The resulting quadratic work can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. The maxDepth option does not limit key-segment count and therefore does not mitigate this path. This issue is fixed in version 5.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114143","epss":0.00473,"percentile":0.40898,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114143","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"toml","version":"2.3.6"}},"found":{"vulnerabilityID":"GHSA-9j65-hcg3-gc64","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/toml@2.3.6?package-id=2424e5908514dce3","name":"toml","version":"2.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:toml:toml:2.3.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/toml@2.3.6","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6355","dataSource":"https://go.dev/issue/81317","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826524","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.\n\nNow, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.375},"relatedVulnerabilities":[{"id":"CVE-2026-56855","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826524","https://go.dev/issue/81317","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6355"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GO-2026-6355","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-x8mw-p69m-v3mx","dataSource":"https://github.com/advisories/GHSA-x8mw-p69m-v3mx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx","https://nvd.nist.gov/vuln/detail/CVE-2026-19481","https://github.com/fastify/busboy/commit/957a24b66d5915e6d0a6ac988c9dbcee86373e9b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/releases/tag/v3.2.1"],"description":"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19481","epss":0.00493,"percentile":0.42383,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19481","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2026-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.36975},"relatedVulnerabilities":[{"id":"CVE-2026-19481","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19481","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx"],"description":"@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19481","epss":0.00493,"percentile":0.42383,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19481","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/busboy","version":"2.1.1"}},"found":{"vulnerabilityID":"GHSA-x8mw-p69m-v3mx","versionConstraint":">=1.0.0,<3.2.1 (semantic)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:npm/%40fastify/busboy@2.1.1?package-id=23e45e0b3838dc9a","name":"@fastify/busboy","version":"2.1.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:fastify:fastify\\/busyboy:2.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40fastify/busboy@2.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=1482748c5e5e48e1","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=65495197b2cc853c","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.6"],"state":"fixed","available":[{"version":"2.1.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=2.0.0,<2.1.6 (semantic)"},"fix":{"suggestedVersion":"2.1.6"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=a4ce8262f03be3fe","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.6"],"state":"fixed","available":[{"version":"2.1.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=2.0.0,<2.1.6 (semantic)"},"fix":{"suggestedVersion":"2.1.6"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=e23bb758fbfbc9b6","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6617","dataSource":"https://go.dev/cl/847188","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-97032","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-qffp-2rhf-9h96","dataSource":"https://github.com/advisories/GHSA-qffp-2rhf-9h96","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://nvd.nist.gov/vuln/detail/CVE-2026-29786"],"description":"tar has Hardlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2026-03-05","kind":"first-observed"}]},"advisories":[],"risk":0.36580999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-29786","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29786","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://access.redhat.com/security/cve/CVE-2026-29786","https://bugzilla.redhat.com/show_bug.cgi?id=2445476","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29786.json"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.9,"impactScore":4},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-qffp-2rhf-9h96","versionConstraint":"<=7.5.9 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-g4wm-2vf7-vfgr","dataSource":"https://github.com/advisories/GHSA-g4wm-2vf7-vfgr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr","https://nvd.nist.gov/vuln/detail/CVE-2026-102826","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0"],"description":"simple-git allows command execution through unblocked Git configuration includes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102826","epss":0.00464,"percentile":0.40193,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102826","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102826","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.0"],"state":"fixed","available":[{"version":"4.0.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.36192},"relatedVulnerabilities":[{"id":"CVE-2026-102826","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102826","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7","https://github.com/steveukx/git-js/pull/1193","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.0","https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr"],"description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102826","epss":0.00464,"percentile":0.40193,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102826","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102826","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"simple-git","version":"3.24.0"}},"found":{"vulnerabilityID":"GHSA-g4wm-2vf7-vfgr","versionConstraint":"<=3.36.0 (semantic)"},"fix":{"suggestedVersion":"4.0.0"}}],"artifact":{"id":"pkg:npm/simple-git@3.24.0?package-id=645a8534891a91f8","name":"simple-git","version":"3.24.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:simple-git_project:simple-git:3.24.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/simple-git@3.24.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5970","dataSource":"https://go.dev/issue/80142","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/794100"],"description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56852","epss":0.00475,"percentile":0.41065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.39.0"],"state":"fixed","available":[{"version":"0.39.0","date":"2026-06-30","kind":"release"}]},"advisories":[],"risk":0.35624999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-56852","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/794100","https://go.dev/issue/80142","https://pkg.go.dev/vuln/GO-2026-5970"],"description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56852","epss":0.00475,"percentile":0.41065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.23.0"}},"found":{"vulnerabilityID":"GO-2026-5970","versionConstraint":"<0.39.0 (go)"},"fix":{"suggestedVersion":"0.39.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.23.0?package-id=51a8f1ff021f26a0","name":"golang.org/x/text","version":"v0.23.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.23.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.23.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY="}}},{"vulnerability":{"id":"GHSA-q4h4-gmj2-qvw2","dataSource":"https://github.com/advisories/GHSA-q4h4-gmj2-qvw2","namespace":"github:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-46597","https://go.dev/cl/781620","https://go.dev/issue/79561","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5013"],"description":"golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46597","epss":0.00473,"percentile":0.40904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46597","cwe":"CWE-704","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.35475},"relatedVulnerabilities":[{"id":"CVE-2026-46597","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46597","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781620","https://go.dev/issue/79561","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5013"],"description":"An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46597","epss":0.00473,"percentile":0.40904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46597","cwe":"CWE-704","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-q4h4-gmj2-qvw2","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-mwp4-54f8-5fhr","dataSource":"https://github.com/advisories/GHSA-mwp4-54f8-5fhr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"],"description":"ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69192","epss":0.00465,"percentile":0.40276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69192","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69192","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.3.1"],"state":"fixed","available":[{"version":"10.3.1","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.3534},"relatedVulnerabilities":[{"id":"CVE-2026-69192","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69192","epss":0.00465,"percentile":0.40276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69192","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69192","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-mwp4-54f8-5fhr","versionConstraint":"<=10.3.0 (semantic)"},"fix":{"suggestedVersion":"10.3.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=5ae4353344776feb","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-7pqw-9j4j-h8q3","dataSource":"https://github.com/advisories/GHSA-7pqw-9j4j-h8q3","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-19693","https://github.com/max-mapper/extract-zip","https://www.npmjs.com/package/extract-zip","https://github.com/max-mapper/extract-zip/pull/160"],"description":"extract-zip allows arbitrary file writes through symlink archive entries","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19693","epss":0.00453,"percentile":0.39345,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19693","cwe":"CWE-22","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-19693","cwe":"CWE-59","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.35334000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-19693","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19693","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/max-mapper/extract-zip","https://www.npmjs.com/package/extract-zip"],"description":"extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19693","epss":0.00453,"percentile":0.39345,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19693","cwe":"CWE-22","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-19693","cwe":"CWE-59","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"extract-zip","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-7pqw-9j4j-h8q3","versionConstraint":"<=2.0.1 (semantic)"}}],"artifact":{"id":"pkg:npm/extract-zip@2.0.1?package-id=a9c4798828e0b148","name":"extract-zip","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:max-mapper:extract-zip:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/extract-zip@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w879-237q-wc7r","dataSource":"https://github.com/advisories/GHSA-w879-237q-wc7r","namespace":"github:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39829","https://go.dev/cl/781641","https://go.dev/cl/781661","https://go.dev/issue/79565","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5018","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/security/cve/CVE-2026-39829","https://bugzilla.redhat.com/show_bug.cgi?id=2480681","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41055"],"description":"golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39829","epss":0.00467,"percentile":0.40443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39829","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39829","cwe":"CWE-1284","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-39829","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39829","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781641","https://go.dev/cl/781661","https://go.dev/issue/79565","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5018","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39829","https://bugzilla.redhat.com/show_bug.cgi?id=2480681","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json"],"description":"The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39829","epss":0.00467,"percentile":0.40443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39829","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39829","cwe":"CWE-1284","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-w879-237q-wc7r","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-v245-v573-v5vm","dataSource":"https://github.com/advisories/GHSA-v245-v573-v5vm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm","https://nvd.nist.gov/vuln/detail/CVE-2026-59887","https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe","https://github.com/markdown-it/linkify-it/releases/tag/5.0.2"],"description":"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59887","epss":0.00467,"percentile":0.40435,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59887","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.2"],"state":"fixed","available":[{"version":"5.0.2","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-59887","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59887","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe","https://github.com/markdown-it/linkify-it/releases/tag/5.0.2","https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm"],"description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59887","epss":0.00467,"percentile":0.40435,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59887","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"linkify-it","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-v245-v573-v5vm","versionConstraint":"<=5.0.1 (semantic)"},"fix":{"suggestedVersion":"5.0.2"}}],"artifact":{"id":"pkg:npm/linkify-it@5.0.0?package-id=5a20f8f3d60d6261","name":"linkify-it","version":"5.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:linkify-it:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify-it:linkify_it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify_it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify_it:5.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/linkify-it@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6629","dataSource":"https://go.dev/cl/793360","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/80112"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.41.0"],"state":"fixed","available":[{"version":"0.41.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.3495},"relatedVulnerabilities":[{"id":"CVE-2026-56851","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/793360","https://go.dev/issue/80112","https://pkg.go.dev/vuln/GO-2026-6629"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.23.0"}},"found":{"vulnerabilityID":"GO-2026-6629","versionConstraint":"<0.41.0 (go)"},"fix":{"suggestedVersion":"0.41.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.23.0?package-id=51a8f1ff021f26a0","name":"golang.org/x/text","version":"v0.23.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.23.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.23.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY="}}},{"vulnerability":{"id":"GHSA-47q9-m4ww-924m","dataSource":"https://github.com/advisories/GHSA-47q9-m4ww-924m","namespace":"github:language:go","severity":"High","urls":["https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m"],"description":"Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48702","epss":0.0046,"percentile":0.3989,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48702","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.5.2"],"state":"fixed","available":[{"version":"1.5.2","date":"2026-06-26","kind":"first-observed"}]},"advisories":[],"risk":0.345},"relatedVulnerabilities":[{"id":"CVE-2026-48702","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48702","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m"],"description":"Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48702","epss":0.0046,"percentile":0.3989,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48702","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/rekor","version":"v1.3.8"}},"found":{"vulnerabilityID":"GHSA-47q9-m4ww-924m","versionConstraint":">=0.3.0,<1.5.2 (go)"},"fix":{"suggestedVersion":"1.5.2"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/rekor@v1.3.8?package-id=29a2760afde8f6b1","name":"github.com/sigstore/rekor","version":"v1.3.8","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:rekor:v1.3.8:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/rekor@v1.3.8","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:B8kJI8mpSIXova4Jxa6vXdJyysRxFGsEsLKBDl0rRjA="}}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=1482748c5e5e48e1","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=65495197b2cc853c","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.5"],"state":"fixed","available":[{"version":"2.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=2.0.0,<2.1.5 (semantic)"},"fix":{"suggestedVersion":"2.1.5"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=e23bb758fbfbc9b6","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.5"],"state":"fixed","available":[{"version":"2.1.5","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=2.0.0,<2.1.5 (semantic)"},"fix":{"suggestedVersion":"2.1.5"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=a4ce8262f03be3fe","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8x88-c5mf-7j5w","dataSource":"https://github.com/advisories/GHSA-8x88-c5mf-7j5w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://nvd.nist.gov/vuln/detail/CVE-2026-59874","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Negative tar entry size causes infinite loop in archive replace","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33852},"relatedVulnerabilities":[{"id":"CVE-2026-59874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-8x88-c5mf-7j5w","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-x6jw-m9v5-85vh","dataSource":"https://github.com/advisories/GHSA-x6jw-m9v5-85vh","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh","https://nvd.nist.gov/vuln/detail/CVE-2026-102828","https://github.com/steveukx/git-js/pull/1198","https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1"],"description":"simple-git unsafe-operation guard does not block trailer command configuration","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102828","epss":0.0037,"percentile":0.30936,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102828","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102828","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.1"],"state":"fixed","available":[{"version":"4.0.1","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.3367},"relatedVulnerabilities":[{"id":"CVE-2026-102828","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102828","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3","https://github.com/steveukx/git-js/pull/1198","https://github.com/steveukx/git-js/releases/tag/simple-git@4.0.1","https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh"],"description":"simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<token>.cmd as unsafe configuration. An application that passes attacker-controlled values through SimpleGitOptions.config or inline -c arguments can therefore allow Git to invoke an attacker-selected shell command when git interpret-trailers processes the configured trailer. The command executes with the operating-system identity and permissions of the Node.js process. This issue is fixed in 4.0.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102828","epss":0.0037,"percentile":0.30936,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102828","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102828","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"simple-git","version":"3.24.0"}},"found":{"vulnerabilityID":"GHSA-x6jw-m9v5-85vh","versionConstraint":">=3.15.0,<4.0.1 (semantic)"},"fix":{"suggestedVersion":"4.0.1"}}],"artifact":{"id":"pkg:npm/simple-git@3.24.0?package-id=645a8534891a91f8","name":"simple-git","version":"3.24.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:simple-git_project:simple-git:3.24.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/simple-git@3.24.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4qg8-fj49-pxjh","dataSource":"https://github.com/advisories/GHSA-4qg8-fj49-pxjh","namespace":"github:language:go","severity":"High","urls":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-4qg8-fj49-pxjh","https://nvd.nist.gov/vuln/detail/CVE-2025-66564","https://github.com/sigstore/timestamp-authority/commit/0cae34e197d685a14904e0bad135b89d13b69421"],"description":"Sigstore Timestamp Authority allocates excessive memory during request parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66564","epss":0.00443,"percentile":0.38498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66564","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.3"],"state":"fixed","available":[{"version":"2.0.3","date":"2025-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.33225},"relatedVulnerabilities":[{"id":"CVE-2025-66564","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66564","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/timestamp-authority/commit/0cae34e197d685a14904e0bad135b89d13b69421","https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-4qg8-fj49-pxjh"],"description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66564","epss":0.00443,"percentile":0.38498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66564","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/timestamp-authority","version":"v1.2.2"}},"found":{"vulnerabilityID":"GHSA-4qg8-fj49-pxjh","versionConstraint":"<=2.0.2 (go)"},"fix":{"suggestedVersion":"2.0.3"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2?package-id=f89b0bf61be9ed87","name":"github.com/sigstore/timestamp-authority","version":"v1.2.2","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:timestamp-authority:v1.2.2:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:timestamp_authority:v1.2.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4qyutnCQqJ0apMewFyx+3t7Tws00JQ/JonBiu3QvLE="}}},{"vulnerability":{"id":"GHSA-w8wr-v893-vjvp","dataSource":"https://github.com/advisories/GHSA-w8wr-v893-vjvp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","https://nvd.nist.gov/vuln/detail/CVE-2026-59871","https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Process crash via PAX numeric path type confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33166},"relatedVulnerabilities":[{"id":"CVE-2026-59871","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-w8wr-v893-vjvp","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-9qmh-m7c6-f92p","dataSource":"https://github.com/advisories/GHSA-9qmh-m7c6-f92p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p","https://nvd.nist.gov/vuln/detail/CVE-2026-114144","https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"description":"toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114144","epss":0.0044,"percentile":0.38281,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114144","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114144","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.33},"relatedVulnerabilities":[{"id":"CVE-2026-114144","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114144","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/BinaryMuse/toml-node/commit/9d52e384f6030932174d1afb0d910154dd62dead","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-9qmh-m7c6-f92p"],"description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before reduceInteger() in lib/compiler.js checks whether the resulting value fits the TOML 64-bit integer range. Converting a sufficiently long integer string consumes super-linear CPU time and synchronously blocks the Node.js event loop, allowing one attacker-supplied TOML document to deny service to concurrent work in the process. The later range check cannot prevent the conversion cost because it executes after BigInt(). This issue is fixed in version 5.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114144","epss":0.0044,"percentile":0.38281,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114144","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114144","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"toml","version":"2.3.6"}},"found":{"vulnerabilityID":"GHSA-9qmh-m7c6-f92p","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/toml@2.3.6?package-id=2424e5908514dce3","name":"toml","version":"2.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:toml:toml:2.3.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/toml@2.3.6","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6303","dataSource":"https://go.dev/issue/80213","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/797040"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.32775},"relatedVulnerabilities":[{"id":"CVE-2026-56854","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56854","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/797040","https://go.dev/issue/80213","https://pkg.go.dev/vuln/GO-2026-6303"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GO-2026-6303","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GO-2026-6354","dataSource":"https://go.dev/issue/81316","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826504","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.32325},"relatedVulnerabilities":[{"id":"CVE-2026-78662","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78662","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826504","https://go.dev/issue/81316","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6354"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GO-2026-6354","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-22p9-wv53-3rq4","dataSource":"https://github.com/advisories/GHSA-22p9-wv53-3rq4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"],"description":"LinkifyIt#match scan loop has quadratic algorithmic complexity","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48801","epss":0.00394,"percentile":0.33576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48801","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-06-27","kind":"first-observed"}]},"advisories":[],"risk":0.31914},"relatedVulnerabilities":[{"id":"CVE-2026-48801","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"],"description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48801","epss":0.00394,"percentile":0.33576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48801","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"linkify-it","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-22p9-wv53-3rq4","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/linkify-it@5.0.0?package-id=5a20f8f3d60d6261","name":"linkify-it","version":"5.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:linkify-it:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify-it:linkify_it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify_it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify-it:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify_it:5.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/linkify-it@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6610","dataSource":"https://go.dev/cl/835145","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-78660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-846p-jg2w-w324","dataSource":"https://github.com/advisories/GHSA-846p-jg2w-w324","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324","https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1","https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6","https://nvd.nist.gov/vuln/detail/CVE-2026-23991"],"description":"go-tuf affected by client DoS via malformed server response","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23991","epss":0.00581,"percentile":0.47778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23991","cwe":"CWE-617","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23991","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.1"],"state":"fixed","available":[{"version":"2.3.1","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.316645},"relatedVulnerabilities":[{"id":"CVE-2026-23991","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23991","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/theupdateframework/go-tuf/commit/73345ab6b0eb7e59d525dac17a428f043074cef6","https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1","https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-846p-jg2w-w324"],"description":"go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23991","epss":0.00581,"percentile":0.47778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23991","cwe":"CWE-617","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23991","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/theupdateframework/go-tuf/v2","version":"v2.0.1"}},"found":{"vulnerabilityID":"GHSA-846p-jg2w-w324","versionConstraint":"<2.3.1 (go)"},"fix":{"suggestedVersion":"2.3.1"}}],"artifact":{"id":"pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.0.1?package-id=aeb556b4fec7e449","name":"github.com/theupdateframework/go-tuf/v2","version":"v2.0.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:theupdateframework:go-tuf\\/v2:v2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:theupdateframework:go_tuf\\/v2:v2.0.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.0.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:11p9tXpq10KQEujxjcIjDSivMKCMLguls7erXHZnxJQ="}}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/runtime","version":"7.21.0"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/runtime@7.21.0?package-id=941b0af04a47c6d0","name":"@babel/runtime","version":"7.21.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/runtime:\\@babel\\/runtime:7.21.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/runtime@7.21.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/runtime-corejs3","version":"7.24.5"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/runtime-corejs3@7.24.5?package-id=51f33b703451c670","name":"@babel/runtime-corejs3","version":"7.24.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/runtime-corejs3:\\@babel\\/runtime-corejs3:7.24.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/runtime-corejs3:\\@babel\\/runtime_corejs3:7.24.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/runtime_corejs3:\\@babel\\/runtime-corejs3:7.24.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/runtime_corejs3:\\@babel\\/runtime_corejs3:7.24.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/runtime:\\@babel\\/runtime-corejs3:7.24.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/runtime:\\@babel\\/runtime_corejs3:7.24.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/runtime-corejs3@7.24.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2c7-rcm5-vvqj","dataSource":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj","https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://nvd.nist.gov/vuln/detail/CVE-2026-33671"],"description":"Picomatch has a ReDoS vulnerability via extglob quantifiers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.315},"relatedVulnerabilities":[{"id":"CVE-2026-33671","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33671","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-c2c7-rcm5-vvqj","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.3.1?package-id=a552dd7b02511da8","name":"picomatch","version":"2.3.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2c7-rcm5-vvqj","dataSource":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj","https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://nvd.nist.gov/vuln/detail/CVE-2026-33671"],"description":"Picomatch has a ReDoS vulnerability via extglob quantifiers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.315},"relatedVulnerabilities":[{"id":"CVE-2026-33671","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33671","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-c2c7-rcm5-vvqj","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.3.1?package-id=9753bca4aa0b315b","name":"picomatch","version":"2.3.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mwcw-c2x4-8c55","dataSource":"https://github.com/advisories/GHSA-mwcw-c2x4-8c55","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55565","https://github.com/ai/nanoid/pull/510","https://github.com/ai/nanoid/compare/3.3.7...3.3.8","https://github.com/ai/nanoid/releases/tag/5.0.9","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html"],"description":"Predictable results in nanoid generation when given non-integer values","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-55565","epss":0.00665,"percentile":0.51791,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-55565","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.3.8"],"state":"fixed","available":[{"version":"3.3.8","date":"2024-12-10","kind":"first-observed"}]},"advisories":[],"risk":0.30922499999999997},"relatedVulnerabilities":[{"id":"CVE-2024-55565","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55565","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ai/nanoid/compare/3.3.7...3.3.8","https://github.com/ai/nanoid/pull/510","https://github.com/ai/nanoid/releases/tag/5.0.9","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html"],"description":"nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-55565","epss":0.00665,"percentile":0.51791,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-55565","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.7"}},"found":{"vulnerabilityID":"GHSA-mwcw-c2x4-8c55","versionConstraint":"<3.3.8 (semantic)"},"fix":{"suggestedVersion":"3.3.8"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.7?package-id=e6ceff9b0d7e9f4e","name":"nanoid","version":"3.3.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-j5w8-q4qc-rx2x","dataSource":"https://github.com/advisories/GHSA-j5w8-q4qc-rx2x","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-58181","https://go.dev/cl/721961","https://go.dev/issue/76363","https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA","https://pkg.go.dev/vuln/GO-2025-4134"],"description":"golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58181","epss":0.00597,"percentile":0.48536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-58181","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.45.0"],"state":"fixed","available":[{"version":"0.45.0","date":"2025-11-20","kind":"first-observed"}]},"advisories":[],"risk":0.307455},"relatedVulnerabilities":[{"id":"CVE-2025-58181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58181","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/721961","https://go.dev/issue/76363","https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA","https://pkg.go.dev/vuln/GO-2025-4134"],"description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58181","epss":0.00597,"percentile":0.48536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-58181","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-j5w8-q4qc-rx2x","versionConstraint":"<0.45.0 (go)"},"fix":{"suggestedVersion":"0.45.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-2mjp-6q6p-2qxm","dataSource":"https://github.com/advisories/GHSA-2mjp-6q6p-2qxm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm","https://nvd.nist.gov/vuln/detail/CVE-2026-1525","https://hackerone.com/reports/3556037","https://cna.openjsf.org/security-advisories.html","https://cwe.mitre.org/data/definitions/444.html","https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"],"description":"Undici has an HTTP Request/Response Smuggling issue","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-1525","epss":0.00524,"percentile":0.44459,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-1525","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.24.0"],"state":"fixed","available":[{"version":"6.24.0","date":"2026-03-14","kind":"first-observed"}]},"advisories":[],"risk":0.30129999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-1525","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1525","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://cwe.mitre.org/data/definitions/444.html","https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm","https://hackerone.com/reports/3556037","https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"],"description":"Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.\n\nWho is impacted:\n\n  *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n  *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)\n  *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-1525","epss":0.00524,"percentile":0.44459,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-1525","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-2mjp-6q6p-2qxm","versionConstraint":"<6.24.0 (semantic)"},"fix":{"suggestedVersion":"6.24.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-01-17","kind":"first-observed"}]},"advisories":[],"risk":0.29516},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23745","https://bugzilla.redhat.com/show_bug.cgi?id=2430538","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-4440","dataSource":"https://go.dev/cl/709876","namespace":"govulndb:language:go","severity":"Medium","urls":["https://github.com/golang/vulndb/issues/4440","https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c"],"description":"The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47911","epss":0.0057,"percentile":0.47166,"date":"2026-10-31"}],"fix":{"versions":["0.45.0"],"state":"fixed","available":[{"version":"0.45.0","date":"2025-10-07","kind":"release"}]},"advisories":[],"risk":0.29355000000000003},"relatedVulnerabilities":[{"id":"CVE-2025-47911","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47911","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/golang/vulndb/issues/4440","https://go.dev/cl/709876","https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","https://pkg.go.dev/vuln/GO-2026-4440"],"description":"The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47911","epss":0.0057,"percentile":0.47166,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-4440","versionConstraint":"<0.45.0 (go)"},"fix":{"suggestedVersion":"0.45.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.14.0"],"state":"fixed","available":[{"version":"6.14.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"6.12.6"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":"<6.14.0 (semantic)"},"fix":{"suggestedVersion":"6.14.0"}}],"artifact":{"id":"pkg:npm/ajv@6.12.6?package-id=c4fa3a81bc3710d2","name":"ajv","version":"6.12.6","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:6.12.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@6.12.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-4p3w-j4w9-5jqw","dataSource":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495","https://github.com/moment/moment/pull/6386","https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07","https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/releases/tag/2.31.0"],"description":"moment vulnerable to Path Traversal via crafted non-string locale name","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-17495","epss":0.00519,"percentile":0.44161,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.31.0"],"state":"fixed","available":[{"version":"2.31.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.282855},"relatedVulnerabilities":[{"id":"CVE-2026-17495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17495","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw"],"description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-17495","epss":0.00519,"percentile":0.44161,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.30.1"}},"found":{"vulnerabilityID":"GHSA-4p3w-j4w9-5jqw","versionConstraint":">=2.29.2,<2.31.0 (semantic)"},"fix":{"suggestedVersion":"2.31.0"}}],"artifact":{"id":"pkg:npm/moment@2.30.1?package-id=9764194d3488b3e1","name":"moment","version":"2.30.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:momentjs:moment:2.30.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.30.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-4441","dataSource":"https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","namespace":"govulndb:language:go","severity":"Medium","urls":["https://github.com/golang/vulndb/issues/4441","https://go.dev/cl/709875"],"description":"The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58190","epss":0.00548,"percentile":0.45901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-58190","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.45.0"],"state":"fixed","available":[{"version":"0.45.0","date":"2025-10-07","kind":"release"}]},"advisories":[],"risk":0.28221999999999997},"relatedVulnerabilities":[{"id":"CVE-2025-58190","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58190","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/golang/vulndb/issues/4441","https://go.dev/cl/709875","https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","https://pkg.go.dev/vuln/GO-2026-4441"],"description":"The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58190","epss":0.00548,"percentile":0.45901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-58190","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-4441","versionConstraint":"<0.45.0 (go)"},"fix":{"suggestedVersion":"0.45.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-f6x5-jh6r-wrfv","dataSource":"https://github.com/advisories/GHSA-f6x5-jh6r-wrfv","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-47914","https://go.dev/cl/721960","https://go.dev/issue/76364","https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA","https://pkg.go.dev/vuln/GO-2025-4135"],"description":"golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47914","epss":0.00546,"percentile":0.45822,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-47914","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.45.0"],"state":"fixed","available":[{"version":"0.45.0","date":"2025-11-21","kind":"first-observed"}]},"advisories":[],"risk":0.28119},"relatedVulnerabilities":[{"id":"CVE-2025-47914","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47914","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/721960","https://go.dev/issue/76364","https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA","https://pkg.go.dev/vuln/GO-2025-4135"],"description":"SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47914","epss":0.00546,"percentile":0.45822,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-47914","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-f6x5-jh6r-wrfv","versionConstraint":"<0.45.0 (go)"},"fix":{"suggestedVersion":"0.45.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-378v-28hj-76wf","dataSource":"https://github.com/advisories/GHSA-378v-28hj-76wf","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-2739","https://github.com/indutny/bn.js/issues/186","https://github.com/indutny/bn.js/issues/316","https://github.com/indutny/bn.js/pull/317","https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b","https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91","https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301","https://github.com/indutny/bn.js/releases/tag/v5.2.3","https://github.com/indutny/bn.js/issues/316#issuecomment-3924217358"],"description":"bn.js affected by an infinite loop","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2739","epss":0.00531,"percentile":0.44897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2739","cwe":"CWE-835","source":"report@snyk.io","type":"Secondary"}],"fix":{"versions":["4.12.3"],"state":"fixed","available":[{"version":"4.12.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.27612},"relatedVulnerabilities":[{"id":"CVE-2026-2739","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2739","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91","https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b","https://github.com/indutny/bn.js/issues/186","https://github.com/indutny/bn.js/issues/316","https://github.com/indutny/bn.js/pull/317","https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301"],"description":"This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2739","epss":0.00531,"percentile":0.44897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2739","cwe":"CWE-835","source":"report@snyk.io","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"bn.js","version":"4.12.0"}},"found":{"vulnerabilityID":"GHSA-378v-28hj-76wf","versionConstraint":"<4.12.3 (semantic)"},"fix":{"suggestedVersion":"4.12.3"}}],"artifact":{"id":"pkg:npm/bn.js@4.12.0?package-id=f5a65e534bd825e7","name":"bn.js","version":"4.12.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:bn.js:bn.js:4.12.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/bn.js@4.12.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mgcc-cww5-fp2q","dataSource":"https://github.com/advisories/GHSA-mgcc-cww5-fp2q","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116587","https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6"],"description":"Go JOSE: DoS when parsing JWKs that contain RSA keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.6"],"state":"fixed","available":[{"version":"4.1.6","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.2745},"relatedVulnerabilities":[{"id":"CVE-2026-116587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116587","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6","https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.0.5"}},"found":{"vulnerabilityID":"GHSA-mgcc-cww5-fp2q","versionConstraint":"<=4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.6"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5?package-id=f213d0688efe1976","name":"github.com/go-jose/go-jose/v4","version":"v4.0.5","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE="}}},{"vulnerability":{"id":"GHSA-78mq-xcr3-xm33","dataSource":"https://github.com/advisories/GHSA-78mq-xcr3-xm33","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39835","https://go.dev/cl/781660","https://go.dev/issue/79563","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5015","https://access.redhat.com/security/cve/CVE-2026-39835","https://bugzilla.redhat.com/show_bug.cgi?id=2480680","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:51036","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521"],"description":"golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39835","epss":0.00504,"percentile":0.43093,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39835","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39835","cwe":"CWE-476","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.25956},"relatedVulnerabilities":[{"id":"CVE-2026-39835","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39835","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781660","https://go.dev/issue/79563","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5015","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51036","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-39835","https://bugzilla.redhat.com/show_bug.cgi?id=2480680","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json"],"description":"SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39835","epss":0.00504,"percentile":0.43093,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39835","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39835","cwe":"CWE-476","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-78mq-xcr3-xm33","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=1482748c5e5e48e1","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=65495197b2cc853c","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.3"],"state":"fixed","available":[{"version":"2.0.3","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":">=2.0.0,<2.0.3 (semantic)"},"fix":{"suggestedVersion":"2.0.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=e23bb758fbfbc9b6","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.3"],"state":"fixed","available":[{"version":"2.0.3","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":">=2.0.0,<2.0.3 (semantic)"},"fix":{"suggestedVersion":"2.0.3"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=a4ce8262f03be3fe","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=1482748c5e5e48e1","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=65495197b2cc853c","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.2"],"state":"fixed","available":[{"version":"2.1.2","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":">=2.0.0,<2.1.2 (semantic)"},"fix":{"suggestedVersion":"2.1.2"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=e23bb758fbfbc9b6","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.2"],"state":"fixed","available":[{"version":"2.1.2","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":">=2.0.0,<2.1.2 (semantic)"},"fix":{"suggestedVersion":"2.1.2"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=a4ce8262f03be3fe","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-jp2q-39xq-3w4g","dataSource":"https://github.com/advisories/GHSA-jp2q-39xq-3w4g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g","https://nvd.nist.gov/vuln/detail/CVE-2026-33349","https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7","https://github.com/NaturalIntelligence/fast-xml-parser/commit/88d0936a23dabe51bfbf42255e2ce912dfee2221"],"description":"Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33349","epss":0.00467,"percentile":0.40444,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33349","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.5.5"],"state":"fixed","available":[{"version":"4.5.5","date":"2026-04-09","kind":"first-observed"}]},"advisories":[],"risk":0.254515},"relatedVulnerabilities":[{"id":"CVE-2026-33349","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33349","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g"],"description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33349","epss":0.00467,"percentile":0.40444,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33349","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-xml-parser","version":"4.2.5"}},"found":{"vulnerabilityID":"GHSA-jp2q-39xq-3w4g","versionConstraint":">=4.0.0-beta.3,<4.5.5 (semantic)"},"fix":{"suggestedVersion":"4.5.5"}}],"artifact":{"id":"pkg:npm/fast-xml-parser@4.2.5?package-id=7b31b6b780a1a92a","name":"fast-xml-parser","version":"4.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:naturalintelligence:fast-xml-parser:4.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/fast-xml-parser@4.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g9mf-h72j-4rw9","dataSource":"https://github.com/advisories/GHSA-g9mf-h72j-4rw9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9","https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3","https://nvd.nist.gov/vuln/detail/CVE-2026-22036"],"description":"Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22036","epss":0.00457,"percentile":0.39633,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22036","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.23.0"],"state":"fixed","available":[{"version":"6.23.0","date":"2026-01-15","kind":"first-observed"}]},"advisories":[],"risk":0.24906500000000004},"relatedVulnerabilities":[{"id":"CVE-2026-22036","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22036","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3","https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9"],"description":"Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22036","epss":0.00457,"percentile":0.39633,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22036","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-g9mf-h72j-4rw9","versionConstraint":"<6.23.0 (semantic)"},"fix":{"suggestedVersion":"6.23.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-v2v4-37r5-5v8g","dataSource":"https://github.com/advisories/GHSA-v2v4-37r5-5v8g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","https://nvd.nist.gov/vuln/detail/CVE-2026-42338"],"description":"ip-address has XSS in Address6 HTML-emitting methods","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42338","epss":0.00471,"percentile":0.4074,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["10.1.1"],"state":"fixed","available":[{"version":"10.1.1","date":"2026-05-06","kind":"first-observed"}]},"advisories":[],"risk":0.242565},"relatedVulnerabilities":[{"id":"CVE-2026-42338","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:35841","https://access.redhat.com/errata/RHSA-2026:35842","https://access.redhat.com/errata/RHSA-2026:35891","https://access.redhat.com/errata/RHSA-2026:35892","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:39246","https://access.redhat.com/errata/RHSA-2026:39868","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41947","https://access.redhat.com/errata/RHSA-2026:44237","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:51200","https://access.redhat.com/errata/RHSA-2026:52399","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62335","https://access.redhat.com/errata/RHSA-2026:62336","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42338","https://bugzilla.redhat.com/show_bug.cgi?id=2476810","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.json"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42338","epss":0.00471,"percentile":0.4074,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-v2v4-37r5-5v8g","versionConstraint":"<=10.1.0 (semantic)"},"fix":{"suggestedVersion":"10.1.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=5ae4353344776feb","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v37-7h3g-55p8","dataSource":"https://github.com/advisories/GHSA-2v37-7h3g-55p8","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67213","https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom","https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b","https://github.com/ai/nanoid/releases/tag/3.3.17","https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0","https://github.com/ai/nanoid/releases/tag/3.3.18"],"description":"nanoid: custom generators can loop indefinitely when size is zero","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.18"],"state":"fixed","available":[{"version":"3.3.18","date":"2026-08-13","kind":"first-observed"}]},"advisories":[],"risk":0.24080250000000003},"relatedVulnerabilities":[{"id":"CVE-2026-67213","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67213","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom"],"description":"nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.7"}},"found":{"vulnerabilityID":"GHSA-2v37-7h3g-55p8","versionConstraint":"<3.3.18 (semantic)"},"fix":{"suggestedVersion":"3.3.18"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.7?package-id=e6ceff9b0d7e9f4e","name":"nanoid","version":"3.3.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-28wg-ghj8-5hjv","dataSource":"https://github.com/advisories/GHSA-28wg-ghj8-5hjv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67214","https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","https://github.com/ai/nanoid/pull/600","https://github.com/ai/nanoid/pull/601","https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d"],"description":"nanoid: non-secure generators can loop indefinitely with negative size","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.16"],"state":"fixed","available":[{"version":"3.3.16","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.240075},"relatedVulnerabilities":[{"id":"CVE-2026-67214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/3.3.16","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"],"description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.7"}},"found":{"vulnerabilityID":"GHSA-28wg-ghj8-5hjv","versionConstraint":"<3.3.16 (semantic)"},"fix":{"suggestedVersion":"3.3.16"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.7?package-id=e6ceff9b0d7e9f4e","name":"nanoid","version":"3.3.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.23944000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xjpj-3mr7-gcpf","dataSource":"https://github.com/advisories/GHSA-xjpj-3mr7-gcpf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33941"],"description":"Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33941","epss":0.00296,"percentile":0.22307,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33941","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.23235999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-33941","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33941","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33941","https://bugzilla.redhat.com/show_bug.cgi?id=2452524","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. Version 4.7.9 fixes the issue. Some workarounds are available. First, validate all CLI inputs before invoking the precompiler. Reject filenames and option values  that contain characters with JavaScript string-escaping significance (`\"`, `'`, `;`, etc.). Second, use a fixed, trusted namespace string passed via a configuration file rather than  command-line arguments in automated pipelines. Third, run the precompiler in a sandboxed environment (container with no write access to sensitive  paths) to limit the impact of successful exploitation. Fourth, audit template filenames in any repository or package that is consumed by an automated  build pipeline.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33941","epss":0.00296,"percentile":0.22307,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33941","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-xjpj-3mr7-gcpf","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5mr-q85p-6hh6","dataSource":"https://github.com/advisories/GHSA-f5mr-q85p-6hh6","namespace":"github:language:go","severity":"High","urls":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6"],"description":"Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49478","epss":0.00282,"percentile":0.20718,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49478","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.8.6"],"state":"fixed","available":[{"version":"1.8.6","date":"2026-07-01","kind":"first-observed"}]},"advisories":[],"risk":0.22841999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-49478","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49478","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/fulcio/commit/378c654f48c3bafdced04ead7010aab2cb4c6ca1","https://github.com/sigstore/fulcio/pull/2354","https://github.com/sigstore/fulcio/releases/tag/v1.8.6","https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6"],"description":"Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49478","epss":0.00282,"percentile":0.20718,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49478","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/fulcio","version":"v1.6.5"}},"found":{"vulnerabilityID":"GHSA-f5mr-q85p-6hh6","versionConstraint":"<=1.8.5 (go)"},"fix":{"suggestedVersion":"1.8.6"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/fulcio@v1.6.5?package-id=1ac9dab65467ecb3","name":"github.com/sigstore/fulcio","version":"v1.6.5","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:fulcio:v1.6.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/fulcio@v1.6.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:A9DtV2hmeJ835mtqqxgvV0Sie0HOPKaLPgvFVF4FU7c="}}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-01-01","kind":"first-observed"}]},"advisories":[],"risk":0.22499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.12.1"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"pkg:npm/qs@6.12.1?package-id=a4dfe5bba47b4488","name":"qs","version":"6.12.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.12.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.12.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6180","dataSource":"https://go.dev/issue/80745","namespace":"govulndb:language:go","severity":"High","urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/815000","https://go.dev/cl/815020"],"description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.\n\nThis attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56864","epss":0.00298,"percentile":0.22508,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.40.0"],"state":"fixed","available":[{"version":"0.40.0","date":"2026-08-13","kind":"release"}]},"advisories":[],"risk":0.2235},"relatedVulnerabilities":[{"id":"CVE-2026-56864","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56864","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/815000","https://go.dev/cl/815020","https://go.dev/issue/80745","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6180"],"description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56864","epss":0.00298,"percentile":0.22508,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/mod","version":"v0.25.0"}},"found":{"vulnerabilityID":"GO-2026-6180","versionConstraint":"<0.40.0 (go)"},"fix":{"suggestedVersion":"0.40.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/mod@v0.25.0?package-id=7087f966620d102b","name":"golang.org/x/mod","version":"v0.25.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:x\\/mod:v0.25.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/mod@v0.25.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w="}}},{"vulnerability":{"id":"GHSA-xwg4-73v4-xw9w","dataSource":"https://github.com/advisories/GHSA-xwg4-73v4-xw9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","https://nvd.nist.gov/vuln/detail/CVE-2026-73086","https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11"],"description":"nanoid: Integer Overflow or Wraparound","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.3.12"],"state":"fixed","available":[{"version":"3.3.12","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.22052},"relatedVulnerabilities":[{"id":"CVE-2026-73086","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11","https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"],"description":"nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.3.7"}},"found":{"vulnerabilityID":"GHSA-xwg4-73v4-xw9w","versionConstraint":"<3.3.12 (semantic)"},"fix":{"suggestedVersion":"3.3.12"}}],"artifact":{"id":"pkg:npm/nanoid@3.3.7?package-id=e6ceff9b0d7e9f4e","name":"nanoid","version":"3.3.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.3.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.3.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=65495197b2cc853c","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=1482748c5e5e48e1","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.7"],"state":"fixed","available":[{"version":"2.1.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=2.0.0,<2.1.7 (semantic)"},"fix":{"suggestedVersion":"2.1.7"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=e23bb758fbfbc9b6","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.7"],"state":"fixed","available":[{"version":"2.1.7","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=2.0.0,<2.1.7 (semantic)"},"fix":{"suggestedVersion":"2.1.7"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=a4ce8262f03be3fe","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-273p-m2cw-6833","dataSource":"https://github.com/advisories/GHSA-273p-m2cw-6833","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/rekor/security/advisories/GHSA-273p-m2cw-6833","https://github.com/sigstore/rekor/commit/39bae3d192bce48ef4ef2cbd1788fb5770fee8cd","https://github.com/sigstore/rekor/releases/tag/v1.5.0","https://nvd.nist.gov/vuln/detail/CVE-2026-23831"],"description":"Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23831","epss":0.00426,"percentile":0.36896,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23831","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.5.0"],"state":"fixed","available":[{"version":"1.5.0","date":"2026-01-23","kind":"first-observed"}]},"advisories":[],"risk":0.21939},"relatedVulnerabilities":[{"id":"CVE-2026-23831","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23831","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/rekor/commit/39bae3d192bce48ef4ef2cbd1788fb5770fee8cd","https://github.com/sigstore/rekor/releases/tag/v1.5.0","https://github.com/sigstore/rekor/security/advisories/GHSA-273p-m2cw-6833"],"description":"Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23831","epss":0.00426,"percentile":0.36896,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23831","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/rekor","version":"v1.3.8"}},"found":{"vulnerabilityID":"GHSA-273p-m2cw-6833","versionConstraint":"<=1.4.3 (go)"},"fix":{"suggestedVersion":"1.5.0"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/rekor@v1.3.8?package-id=29a2760afde8f6b1","name":"github.com/sigstore/rekor","version":"v1.3.8","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:rekor:v1.3.8:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/rekor@v1.3.8","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:B8kJI8mpSIXova4Jxa6vXdJyysRxFGsEsLKBDl0rRjA="}}},{"vulnerability":{"id":"GHSA-3v7f-55p6-f55p","dataSource":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p","https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://nvd.nist.gov/vuln/detail/CVE-2026-33672"],"description":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.21887500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33672","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33672","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-3v7f-55p6-f55p","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.3.1?package-id=9753bca4aa0b315b","name":"picomatch","version":"2.3.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3v7f-55p6-f55p","dataSource":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p","https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://nvd.nist.gov/vuln/detail/CVE-2026-33672"],"description":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.21887500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33672","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33672","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-3v7f-55p6-f55p","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.3.1?package-id=a552dd7b02511da8","name":"picomatch","version":"2.3.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101913","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101913","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.1"],"state":"fixed","available":[{"version":"10.5.1","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.21809},"relatedVulnerabilities":[{"id":"CVE-2026-101913","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101913","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101913","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=5ae4353344776feb","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=c9ca33406d6c0fb3","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":">=4.0.0,<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0027c1be54e9cf42","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":">=4.0.0,<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=c6c6a08d466512f1","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":">=4.0.0,<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0bee311501151095","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101911","epss":0.00383,"percentile":0.32363,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101911","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.7.1"],"state":"fixed","available":[{"version":"10.7.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.216395},"relatedVulnerabilities":[{"id":"CVE-2026-101911","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101911","epss":0.00383,"percentile":0.32363,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101911","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"fix":{"suggestedVersion":"10.7.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=5ae4353344776feb","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-q8mj-m7cp-5q26","dataSource":"https://github.com/advisories/GHSA-q8mj-m7cp-5q26","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","https://nvd.nist.gov/vuln/detail/CVE-2026-8723","https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"],"description":"qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.15.2"],"state":"fixed","available":[{"version":"6.15.2","date":"2026-05-23","kind":"first-observed"}]},"advisories":[],"risk":0.21546},"relatedVulnerabilities":[{"id":"CVE-2026-8723","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26"],"description":"### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.\n\n\n\nSame class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d (\"encode comma values more consistently\", PR #463, 2023-01-19), first released in v6.11.1.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nconst qs = require('qs');\n\n\n\nqs.stringify({ a: [null, 'b'] },      { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [null] },           { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot read properties of null (reading 'length')\n\n\n\n//     at encode (lib/utils.js:195:13)\n\n\n\n//     at Object.maybeMap (lib/utils.js:322:37)\n\n\n\n//     at stringify (lib/stringify.js:145:25)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:\n\n\n\n```diff\n\n\n\n- obj = utils.maybeMap(obj, encoder);\n\n\n\n+ obj = utils.maybeMap(obj, function (v) {\n\n\n\n+     return v == null ? v : encoder(v);\n\n\n\n+ });\n\n\n\n```\n\n\n\n`null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(',')` step as-is. For `{ a: [null, 'b'] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(',') || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.\n\n\n\n### Affected versions\n\n\n\n`>=6.11.1 <6.15.2` — fixed in v6.15.2.\n\n\n\nThe vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + `encodeValuesOnly` path differently (joining before encoding) and are not affected. Empirically verified across released versions.\n\n\n\n### Impact\n\n\n\nApplication code that calls `qs.stringify` with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` (both non-default) on input that may contain a `null` or `undefined` array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The \"kills the worker process\" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.\n\n\n\nThe vulnerable input is a `null` or `undefined` entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal `null`).","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.12.1"}},"found":{"vulnerabilityID":"GHSA-q8mj-m7cp-5q26","versionConstraint":">=6.11.1,<=6.15.1 (semantic)"},"fix":{"suggestedVersion":"6.15.2"}}],"artifact":{"id":"pkg:npm/qs@6.12.1?package-id=a4dfe5bba47b4488","name":"qs","version":"6.12.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.12.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.12.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.21516000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23950","https://bugzilla.redhat.com/show_bug.cgi?id=2431036","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23950.json"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.12.1"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.12.1?package-id=a4dfe5bba47b4488","name":"qs","version":"6.12.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.12.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.12.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-06-29","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":"<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=c9ca33406d6c0fb3","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":">=4.0.0,<=4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0bee311501151095","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":">=4.0.0,<=4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0027c1be54e9cf42","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":">=4.0.0,<=4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=c6c6a08d466512f1","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9m57-25v3-79x9","dataSource":"https://github.com/advisories/GHSA-9m57-25v3-79x9","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-46598","https://go.dev/cl/781360","https://go.dev/issue/79596","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5033"],"description":"golang.org/x/crypto: Invoking pathological inputs can lead to client panic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46598","epss":0.00412,"percentile":0.35519,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46598","cwe":"CWE-129","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.21218},"relatedVulnerabilities":[{"id":"CVE-2026-46598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46598","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781360","https://go.dev/issue/79596","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5033"],"description":"For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46598","epss":0.00412,"percentile":0.35519,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46598","cwe":"CWE-129","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-9m57-25v3-79x9","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-9ppj-qmqm-q256","dataSource":"https://github.com/advisories/GHSA-9ppj-qmqm-q256","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256","https://nvd.nist.gov/vuln/detail/CVE-2026-31802","https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"],"description":"node-tar Symlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.21116500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-31802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31802","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad","https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-9ppj-qmqm-q256","versionConstraint":"<=7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-fcv2-xgw5-pqxf","dataSource":"https://github.com/advisories/GHSA-fcv2-xgw5-pqxf","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf","https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e","https://github.com/sigstore/sigstore/releases/tag/v1.10.4","https://nvd.nist.gov/vuln/detail/CVE-2026-24137","https://pkg.go.dev/vuln/GO-2026-4358"],"description":"sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":1.4,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24137","epss":0.0039,"percentile":0.33206,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24137","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.10.4"],"state":"fixed","available":[{"version":"1.10.4","date":"2026-01-23","kind":"first-observed"}]},"advisories":[],"risk":0.2106},"relatedVulnerabilities":[{"id":"CVE-2026-24137","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24137","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e","https://github.com/sigstore/sigstore/releases/tag/v1.10.4","https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf"],"description":"sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":1.4,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24137","epss":0.0039,"percentile":0.33206,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24137","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/sigstore","version":"v1.8.12"}},"found":{"vulnerabilityID":"GHSA-fcv2-xgw5-pqxf","versionConstraint":"<=1.10.3 (go)"},"fix":{"suggestedVersion":"1.10.4"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/sigstore@v1.8.12?package-id=5ca53d1e3bf7cd51","name":"github.com/sigstore/sigstore","version":"v1.8.12","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:sigstore:v1.8.12:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/sigstore@v1.8.12","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S8xMVZbE2z9ZBuQUEG737pxdLjnbOIcFi5v9UFfkJFc="}}},{"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101912","epss":0.0037,"percentile":0.30998,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101912","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.7.1"],"state":"fixed","available":[{"version":"10.7.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.20904999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-101912","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101912","epss":0.0037,"percentile":0.30998,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101912","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"fix":{"suggestedVersion":"10.7.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=5ae4353344776feb","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-45gg-vh54-h5m9","dataSource":"https://github.com/advisories/GHSA-45gg-vh54-h5m9","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39828","https://go.dev/cl/781621","https://go.dev/issue/79562","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5014","https://access.redhat.com/security/cve/CVE-2026-39828","https://bugzilla.redhat.com/show_bug.cgi?id=2480687","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41055"],"description":"golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39828","epss":0.00369,"percentile":0.30796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39828","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39828","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.208485},"relatedVulnerabilities":[{"id":"CVE-2026-39828","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39828","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781621","https://go.dev/issue/79562","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5014","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-39828","https://bugzilla.redhat.com/show_bug.cgi?id=2480687","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json"],"description":"When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39828","epss":0.00369,"percentile":0.30796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39828","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39828","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-45gg-vh54-h5m9","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"9.0.1"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@9.0.1?package-id=ba1e9012fe74994d","name":"uuid","version":"9.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:uuidjs:uuid:9.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@9.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-4f7v-96qf","dataSource":"https://github.com/advisories/GHSA-8988-4f7v-96qf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf","https://nvd.nist.gov/vuln/detail/CVE-2026-54285"],"description":"OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54285","epss":0.00402,"percentile":0.34485,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54285","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.20703000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-54285","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54285","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf"],"description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54285","epss":0.00402,"percentile":0.34485,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54285","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@opentelemetry/core","version":"1.24.1"}},"found":{"vulnerabilityID":"GHSA-8988-4f7v-96qf","versionConstraint":"<2.8.0 (semantic)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:npm/%40opentelemetry/core@1.24.1?package-id=0e99b01071d1afe1","name":"@opentelemetry/core","version":"1.24.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@opentelemetry\\/core:\\@opentelemetry\\/core:1.24.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40opentelemetry/core@1.24.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.12.1"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.12.1?package-id=a4dfe5bba47b4488","name":"qs","version":"6.12.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.12.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.12.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.3.12"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@10.3.12?package-id=38c1a51c0b74cf6a","name":"glob","version":"10.3.12","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:isaacs:glob:10.3.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.3.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.3.15"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@10.3.15?package-id=5e86db32f3c82b61","name":"glob","version":"10.3.15","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.3.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.3.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-6v5v-wf23-fmfq","dataSource":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"description":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48988","epss":0.00379,"percentile":0.31865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.2.0"],"state":"fixed","available":[{"version":"14.2.0","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.195185},"relatedVulnerabilities":[{"id":"CVE-2026-48988","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48988","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48988","epss":0.00379,"percentile":0.31865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.0"}},"found":{"vulnerabilityID":"GHSA-6v5v-wf23-fmfq","versionConstraint":"<=14.1.1 (semantic)"},"fix":{"suggestedVersion":"14.2.0"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.0?package-id=153988745b47afba","name":"markdown-it","version":"14.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-5cv4-jp36-h3mw","dataSource":"https://github.com/advisories/GHSA-5cv4-jp36-h3mw","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-25680","https://go.dev/cl/781702","https://go.dev/issue/79573","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5028","https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472","https://go.googlesource.com/net/+/refs/tags/v0.55.0"],"description":"Go Net HTML parser is vulnerable to denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25680","epss":0.00326,"percentile":0.25769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25680","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0.18744999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-25680","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25680","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781702","https://go.dev/issue/79573","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5028"],"description":"Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25680","epss":0.00326,"percentile":0.25769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25680","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GHSA-5cv4-jp36-h3mw","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-4c4x-jm2x-pf9j","dataSource":"https://github.com/advisories/GHSA-4c4x-jm2x-pf9j","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/rekor/security/advisories/GHSA-4c4x-jm2x-pf9j","https://github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f","https://github.com/sigstore/rekor/releases/tag/v1.5.0","https://nvd.nist.gov/vuln/detail/CVE-2026-24117"],"description":"Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24117","epss":0.00363,"percentile":0.30187,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24117","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.5.0"],"state":"fixed","available":[{"version":"1.5.0","date":"2026-01-23","kind":"first-observed"}]},"advisories":[],"risk":0.186945},"relatedVulnerabilities":[{"id":"CVE-2026-24117","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24117","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f","https://github.com/sigstore/rekor/releases/tag/v1.5.0","https://github.com/sigstore/rekor/security/advisories/GHSA-4c4x-jm2x-pf9j"],"description":"Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24117","epss":0.00363,"percentile":0.30187,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24117","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/rekor","version":"v1.3.8"}},"found":{"vulnerabilityID":"GHSA-4c4x-jm2x-pf9j","versionConstraint":"<=1.4.3 (go)"},"fix":{"suggestedVersion":"1.5.0"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/rekor@v1.3.8?package-id=29a2760afde8f6b1","name":"github.com/sigstore/rekor","version":"v1.3.8","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:rekor:v1.3.8:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/rekor@v1.3.8","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:B8kJI8mpSIXova4Jxa6vXdJyysRxFGsEsLKBDl0rRjA="}}},{"vulnerability":{"id":"GHSA-cp6g-7hqx-qxhp","dataSource":"https://github.com/advisories/GHSA-cp6g-7hqx-qxhp","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-2303","https://jira.mongodb.org/browse/GODRIVER-3770"],"description":"mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2303","epss":0.00318,"percentile":0.2482,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2303","cwe":"CWE-183","source":"cna@mongodb.com","type":"Secondary"}],"fix":{"versions":["1.17.7"],"state":"fixed","available":[{"version":"1.17.7","date":"2026-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.18602999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-2303","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2303","namespace":"nvd:cpe","severity":"Medium","urls":["https://jira.mongodb.org/browse/GODRIVER-3770"],"description":"The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.","cvss":[{"source":"cna@mongodb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}},{"source":"cna@mongodb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2303","epss":0.00318,"percentile":0.2482,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2303","cwe":"CWE-183","source":"cna@mongodb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.mongodb.org/mongo-driver","version":"v1.14.0"}},"found":{"vulnerabilityID":"GHSA-cp6g-7hqx-qxhp","versionConstraint":"<1.17.7 (go)"},"fix":{"suggestedVersion":"1.17.7"}}],"artifact":{"id":"pkg:golang/go.mongodb.org/mongo-driver@v1.14.0?package-id=045f9df6739f52c2","name":"go.mongodb.org/mongo-driver","version":"v1.14.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":[],"purl":"pkg:golang/go.mongodb.org/mongo-driver@v1.14.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:P98w8egYRjYe3XDjxhYJagTokP/H6HzlsnojRgZRd80="}}},{"vulnerability":{"id":"GHSA-gvwx-54wh-qm9j","dataSource":"https://github.com/advisories/GHSA-gvwx-54wh-qm9j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j","https://nvd.nist.gov/vuln/detail/CVE-2026-59875","https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17"],"description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.17"],"state":"fixed","available":[{"version":"7.5.17","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.18231000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-59875","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-gvwx-54wh-qm9j","versionConstraint":"<=7.5.16 (semantic)"},"fix":{"suggestedVersion":"7.5.17"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w7fw-mjwx-w883","dataSource":"https://github.com/advisories/GHSA-w7fw-mjwx-w883","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://nvd.nist.gov/vuln/detail/CVE-2026-2391","https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"],"description":"qs's arrayLimit bypass in comma parsing allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.2"],"state":"fixed","available":[{"version":"6.14.2","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.18157},"relatedVulnerabilities":[{"id":"CVE-2026-2391","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2391","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"],"description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {\n    return val.split(',');\n}\n\nif (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {\n    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');\n}\n\nreturn val;\n```\nThe `split(',')` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs = require('qs');\n\nconst payload = 'a=' + ','.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n  const result = qs.parse(payload, options);\n  console.log(result.a.length);  // Outputs: 26 (bypass successful)\n} catch (e) {\n  console.log('Limit enforced:', e.message);  // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.12.1"}},"found":{"vulnerabilityID":"GHSA-w7fw-mjwx-w883","versionConstraint":">=6.7.0,<=6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.2"}}],"artifact":{"id":"pkg:npm/qs@6.12.1?package-id=a4dfe5bba47b4488","name":"qs","version":"6.12.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.12.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.12.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-gcqx-w48m-w2h4","dataSource":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93753","https://github.com/TehShrike/deepmerge/issues/273","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge mergeObject() allows prototype poisoning of returned objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-93753","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/TehShrike/deepmerge","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://github.com/TehShrike/deepmerge/issues/273","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"deepmerge","version":"4.3.1"}},"found":{"vulnerabilityID":"GHSA-gcqx-w48m-w2h4","versionConstraint":">=4.2.0,<=4.3.1 (semantic)"}}],"artifact":{"id":"pkg:npm/deepmerge@4.3.1?package-id=5858a9bd9c89fe6b","name":"deepmerge","version":"4.3.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:deepmerge:deepmerge:4.3.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/deepmerge@4.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":["10.7.4"],"state":"fixed","available":[{"version":"10.7.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.177975},"relatedVulnerabilities":[{"id":"CVE-2026-111997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"fix":{"suggestedVersion":"10.7.4"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=5ae4353344776feb","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-gxm5-99cw-xjw9","dataSource":"https://github.com/advisories/GHSA-gxm5-99cw-xjw9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9","https://nvd.nist.gov/vuln/detail/CVE-2026-74866","https://github.com/fastify/busboy/commit/cc7da17c5c88d79c314a9e149a79e5a00a6c23be","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/releases/tag/v3.2.2"],"description":"@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-74866","epss":0.00326,"percentile":0.25728,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-74866","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.2.2"],"state":"fixed","available":[{"version":"3.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.17604},"relatedVulnerabilities":[{"id":"CVE-2026-74866","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74866","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9"],"description":"@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-74866","epss":0.00326,"percentile":0.25728,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-74866","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@fastify/busboy","version":"2.1.1"}},"found":{"vulnerabilityID":"GHSA-gxm5-99cw-xjw9","versionConstraint":"<3.2.2 (semantic)"},"fix":{"suggestedVersion":"3.2.2"}}],"artifact":{"id":"pkg:npm/%40fastify/busboy@2.1.1?package-id=23e45e0b3838dc9a","name":"@fastify/busboy","version":"2.1.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:fastify:fastify\\/busyboy:2.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/%40fastify/busboy@2.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qc2q-p7wx-3px3","dataSource":"https://github.com/advisories/GHSA-qc2q-p7wx-3px3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3","https://nvd.nist.gov/vuln/detail/CVE-2026-84303","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"description":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84303","epss":0.00311,"percentile":0.23996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84303","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.83.1"],"state":"fixed","available":[{"version":"1.83.1","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.17571499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-84303","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84303","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84303","epss":0.00311,"percentile":0.23996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84303","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.69.4"}},"found":{"vulnerabilityID":"GHSA-qc2q-p7wx-3px3","versionConstraint":"<=1.83.0 (go)"},"fix":{"suggestedVersion":"1.83.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.69.4?package-id=1f850ee01658c705","name":"google.golang.org/grpc","version":"v1.69.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.69.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.69.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A="}}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["5.2.2"],"state":"fixed","available":[{"version":"5.2.2","date":"2026-01-21","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"5.2.0"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=5.0.0,<5.2.2 (semantic)"},"fix":{"suggestedVersion":"5.2.2"}}],"artifact":{"id":"pkg:npm/diff@5.2.0?package-id=25f275309b42d9af","name":"diff","version":"5.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:kpdecker:jsdiff:5.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@5.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9fm3-97px-rjf6","dataSource":"https://github.com/advisories/GHSA-9fm3-97px-rjf6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6","https://nvd.nist.gov/vuln/detail/CVE-2026-109932","https://github.com/nodejs/undici/commit/39f93e142df03e559fe7c3d1fc7fba9beee2c185","https://github.com/nodejs/undici/commit/53944624462b6797560288c55dbd8c66857bb495","https://github.com/nodejs/undici/commit/b217373bb024cd93f85eb5b3ffd25684855f60f8","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109932","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109932","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-405","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.29.1"],"state":"fixed","available":[{"version":"6.29.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.17494500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109932","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"],"description":"undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109932","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109932","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-405","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-9fm3-97px-rjf6","versionConstraint":">=5.15.0,<6.29.1 (semantic)"},"fix":{"suggestedVersion":"6.29.1"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vvm8-gf78-28g4","dataSource":"https://github.com/advisories/GHSA-vvm8-gf78-28g4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","https://nvd.nist.gov/vuln/detail/CVE-2026-116586","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panics in JSON parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-116586","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.0.5"}},"found":{"vulnerabilityID":"GHSA-vvm8-gf78-28g4","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5?package-id=f213d0688efe1976","name":"github.com/go-jose/go-jose/v4","version":"v4.0.5","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE="}}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=a7b0933ed4650c5a","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=26a8e8ef1a39a8a8","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.2"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.2?package-id=8dac92e72432bd99","name":"minimatch","version":"9.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.3"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.3?package-id=42f60793ba1d6cbb","name":"minimatch","version":"9.0.3","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=b7de08b769c18701","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=ec7fd1ea758408dd","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-663r-x48j-fg8p","dataSource":"https://github.com/advisories/GHSA-663r-x48j-fg8p","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-12208","https://github.com/OriginSecurityX/jsonata-hasownproperty-bypass","https://vuldb.com/cve/CVE-2026-12208","https://vuldb.com/submit/832446","https://vuldb.com/vuln/370850","https://vuldb.com/vuln/370850/cti","https://github.com/jsonata-js/jsonata/pull/799","https://github.com/jsonata-js/jsonata/pull/806","https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2","https://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159","https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8","https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1"],"description":"jsonata: Function Binding Prototype Pollution via hasOwnProperty Override","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12208","epss":0.00314,"percentile":0.24367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12208","cwe":"CWE-94","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-12208","cwe":"CWE-1321","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["2.2.1"],"state":"fixed","available":[{"version":"2.2.1","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.16328},"relatedVulnerabilities":[{"id":"CVE-2026-12208","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12208","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/OriginSecurityX/jsonata-hasownproperty-bypass","https://vuldb.com/cve/CVE-2026-12208","https://vuldb.com/submit/832446","https://vuldb.com/vuln/370850","https://vuldb.com/vuln/370850/cti"],"description":"A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12208","epss":0.00314,"percentile":0.24367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12208","cwe":"CWE-94","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-12208","cwe":"CWE-1321","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonata","version":"2.0.5"}},"found":{"vulnerabilityID":"GHSA-663r-x48j-fg8p","versionConstraint":">=2.0.0,<2.2.1 (semantic)"},"fix":{"suggestedVersion":"2.2.1"}}],"artifact":{"id":"pkg:npm/jsonata@2.0.5?package-id=25fabe95ef4fd484","name":"jsonata","version":"2.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:jsonata:jsonata:2.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/jsonata@2.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-869p-cjfg-cm3x","dataSource":"https://github.com/advisories/GHSA-869p-cjfg-cm3x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x","https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6","https://github.com/auth0/node-jws/releases/tag/v3.2.3","https://github.com/auth0/node-jws/releases/tag/v4.0.1","https://nvd.nist.gov/vuln/detail/CVE-2025-65945"],"description":"auth0/node-jws Improperly Verifies HMAC Signature","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-65945","epss":0.00215,"percentile":0.1199,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-65945","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.1"],"state":"fixed","available":[{"version":"4.0.1","date":"2025-12-05","kind":"first-observed"}]},"advisories":[],"risk":0.16125},"relatedVulnerabilities":[{"id":"CVE-2025-65945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-65945","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x"],"description":"auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-65945","epss":0.00215,"percentile":0.1199,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-65945","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jws","version":"4.0.0"}},"found":{"vulnerabilityID":"GHSA-869p-cjfg-cm3x","versionConstraint":"=4.0.0 (semantic)"},"fix":{"suggestedVersion":"4.0.1"}}],"artifact":{"id":"pkg:npm/jws@4.0.0?package-id=17e84574c603fdc3","name":"jws","version":"4.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jws:jws:4.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/jws@4.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qpw4-5x99-6vjp","dataSource":"https://github.com/advisories/GHSA-qpw4-5x99-6vjp","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39827","https://go.dev/cl/781320","https://go.dev/issue/35127","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5016"],"description":"golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39827","epss":0.00279,"percentile":0.20461,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39827","cwe":"CWE-924","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.16042499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-39827","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39827","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781320","https://go.dev/issue/35127","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5016"],"description":"An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39827","epss":0.00279,"percentile":0.20461,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39827","cwe":"CWE-924","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GHSA-qpw4-5x99-6vjp","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}},{"vulnerability":{"id":"GHSA-f83f-xpx7-ffpw","dataSource":"https://github.com/advisories/GHSA-f83f-xpx7-ffpw","namespace":"github:language:go","severity":"High","urls":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw","https://nvd.nist.gov/vuln/detail/CVE-2025-66506","https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a"],"description":"Fulcio allocates excessive memory during token parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66506","epss":0.00211,"percentile":0.11378,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66506","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.8.3"],"state":"fixed","available":[{"version":"1.8.3","date":"2025-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.15825},"relatedVulnerabilities":[{"id":"CVE-2025-66506","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66506","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a","https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw"],"description":"Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66506","epss":0.00211,"percentile":0.11378,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66506","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/fulcio","version":"v1.6.5"}},"found":{"vulnerabilityID":"GHSA-f83f-xpx7-ffpw","versionConstraint":"<=1.8.2 (go)"},"fix":{"suggestedVersion":"1.8.3"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/fulcio@v1.6.5?package-id=1ac9dab65467ecb3","name":"github.com/sigstore/fulcio","version":"v1.6.5","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:fulcio:v1.6.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/fulcio@v1.6.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:A9DtV2hmeJ835mtqqxgvV0Sie0HOPKaLPgvFVF4FU7c="}}},{"vulnerability":{"id":"GHSA-4w3g-jfj2-cw2q","dataSource":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116585","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panic during CBC-HMAC processing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.15708},"relatedVulnerabilities":[{"id":"CVE-2026-116585","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.0.5"}},"found":{"vulnerabilityID":"GHSA-4w3g-jfj2-cw2q","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5?package-id=f213d0688efe1976","name":"github.com/go-jose/go-jose/v4","version":"v4.0.5","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.0.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.0.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE="}}},{"vulnerability":{"id":"GHSA-fj3w-jwp8-x2g3","dataSource":"https://github.com/advisories/GHSA-fj3w-jwp8-x2g3","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3","https://nvd.nist.gov/vuln/detail/CVE-2026-27942","https://github.com/NaturalIntelligence/fast-xml-parser/pull/791","https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a"],"description":"fast-xml-parser has stack overflow in XMLBuilder with preserveOrder","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27942","epss":0.00543,"percentile":0.45638,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27942","cwe":"CWE-120","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.5.4"],"state":"fixed","available":[{"version":"4.5.4","date":"2026-03-02","kind":"first-observed"}]},"advisories":[],"risk":0.15475500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-27942","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27942","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a","https://github.com/NaturalIntelligence/fast-xml-parser/pull/791","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3"],"description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27942","epss":0.00543,"percentile":0.45638,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27942","cwe":"CWE-120","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-xml-parser","version":"4.2.5"}},"found":{"vulnerabilityID":"GHSA-fj3w-jwp8-x2g3","versionConstraint":">=4.0.0-beta.0,<4.5.4 (semantic)"},"fix":{"suggestedVersion":"4.5.4"}}],"artifact":{"id":"pkg:npm/fast-xml-parser@4.2.5?package-id=7b31b6b780a1a92a","name":"fast-xml-parser","version":"4.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:naturalintelligence:fast-xml-parser:4.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/fast-xml-parser@4.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["1.1.12"],"state":"fixed","available":[{"version":"1.1.12","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=1.0.0,<=1.1.11 (semantic)"},"fix":{"suggestedVersion":"1.1.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=1482748c5e5e48e1","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["1.1.12"],"state":"fixed","available":[{"version":"1.1.12","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=1.0.0,<=1.1.11 (semantic)"},"fix":{"suggestedVersion":"1.1.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=65495197b2cc853c","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["2.0.2"],"state":"fixed","available":[{"version":"2.0.2","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=2.0.0,<=2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.2"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=e23bb758fbfbc9b6","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["2.0.2"],"state":"fixed","available":[{"version":"2.0.2","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=2.0.0,<=2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.2"}}],"artifact":{"id":"pkg:npm/brace-expansion@2.0.1?package-id=a4ce8262f03be3fe","name":"brace-expansion","version":"2.0.1","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-j5f4-cc29-5x44","dataSource":"https://github.com/advisories/GHSA-j5f4-cc29-5x44","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"],"description":"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102282","epss":0.00199,"percentile":0.09819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102282","cwe":"CWE-732","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.6.1"],"state":"fixed","available":[{"version":"0.6.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.14526999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-102282","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102282","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44"],"description":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102282","epss":0.00199,"percentile":0.09819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102282","cwe":"CWE-732","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"adm-zip","version":"0.5.12"}},"found":{"vulnerabilityID":"GHSA-j5f4-cc29-5x44","versionConstraint":"<=0.6.0 (semantic)"},"fix":{"suggestedVersion":"0.6.1"}}],"artifact":{"id":"pkg:npm/adm-zip@0.5.12?package-id=12e43dec75aa588f","name":"adm-zip","version":"0.5.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adm-zip_project:adm-zip:0.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/adm-zip@0.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-vfgh-jcmw-g37q","dataSource":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://nvd.nist.gov/vuln/detail/CVE-2026-111766","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"description":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111766","epss":0.00428,"percentile":0.37065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111766","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.3"],"state":"fixed","available":[{"version":"14.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.14337999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-111766","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111766","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"],"description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111766","epss":0.00428,"percentile":0.37065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111766","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.0"}},"found":{"vulnerabilityID":"GHSA-vfgh-jcmw-g37q","versionConstraint":"<14.3.3 (semantic)"},"fix":{"suggestedVersion":"14.3.3"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.0?package-id=153988745b47afba","name":"markdown-it","version":"14.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8xcm-r25x-g524","dataSource":"https://github.com/advisories/GHSA-8xcm-r25x-g524","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524","https://nvd.nist.gov/vuln/detail/CVE-2026-16728","https://github.com/nodejs/undici/commit/1b5a5312c3a7d7a30c31bf0d000b39a8a2531e1c","https://github.com/nodejs/undici/commit/2b3f749336d356bbbc50192f87f6cf7bc714721a","https://github.com/nodejs/undici/commit/4a9dafb16ff43880cf590e6d9c2aeee25fbff6d7","https://github.com/nodejs/undici/commit/4fd5a0c61e627f928b7003adc4ffe1e55ec63420","https://github.com/nodejs/undici/commit/cba3a52ac2e7abcc4e656d82af8579ea82c2bb9e","https://github.com/nodejs/undici/commit/e11a68ed4ff345c79402476f7a00d473443e318d","https://hackerone.com/reports/3828685","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.0","https://github.com/nodejs/undici/releases/tag/v7.29.0","https://github.com/nodejs/undici/releases/tag/v8.9.0"],"description":"undici vulnerable to downstream response desynchronization via retry interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16728","epss":0.00288,"percentile":0.21384,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16728","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.28.0"],"state":"fixed","available":[{"version":"6.28.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.14112},"relatedVulnerabilities":[{"id":"CVE-2026-16728","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16728","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524"],"description":"undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16728","epss":0.00288,"percentile":0.21384,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16728","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-8xcm-r25x-g524","versionConstraint":"<6.28.0 (semantic)"},"fix":{"suggestedVersion":"6.28.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xw65-4hp5-5hc7","dataSource":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","https://nvd.nist.gov/vuln/detail/CVE-2026-106444","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106444","epss":0.0029,"percentile":0.21631,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.14064999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-106444","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106444","epss":0.0029,"percentile":0.21631,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-xw65-4hp5-5hc7","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-qrxm-fqhp-jwvm","dataSource":"https://github.com/advisories/GHSA-qrxm-fqhp-jwvm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm","https://nvd.nist.gov/vuln/detail/CVE-2026-87018","https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309","https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28","https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87018","epss":0.00187,"percentile":0.08364,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87018","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87018","cwe":"CWE-617","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.29.1"],"state":"fixed","available":[{"version":"6.29.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.14024999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-87018","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"],"description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87018","epss":0.00187,"percentile":0.08364,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87018","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87018","cwe":"CWE-617","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-qrxm-fqhp-jwvm","versionConstraint":">=4.2.1,<6.29.1 (semantic)"},"fix":{"suggestedVersion":"6.29.1"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p88m-4jfj-68fv","dataSource":"https://github.com/advisories/GHSA-p88m-4jfj-68fv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv","https://nvd.nist.gov/vuln/detail/CVE-2026-9679","https://cna.openjsf.org/security-advisories.html"],"description":"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9679","epss":0.00257,"percentile":0.1743,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9679","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.27.0"],"state":"fixed","available":[{"version":"6.27.0","date":"2026-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.140065},"relatedVulnerabilities":[{"id":"CVE-2026-9679","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9679","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv"],"description":"Impact:\nundici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.\n\nAffected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.\n\nThis was introduced in undici 7.0.0 via PR #3789.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nIf upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9679","epss":0.00257,"percentile":0.1743,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9679","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-p88m-4jfj-68fv","versionConstraint":"<6.27.0 (semantic)"},"fix":{"suggestedVersion":"6.27.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4992-7rv2-5pvq","dataSource":"https://github.com/advisories/GHSA-4992-7rv2-5pvq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq","https://nvd.nist.gov/vuln/detail/CVE-2026-1527","https://hackerone.com/reports/3487198","https://cna.openjsf.org/security-advisories.html"],"description":"Undici has CRLF Injection in undici via `upgrade` option","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.6,"exploitabilityScore":2.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-1527","epss":0.00287,"percentile":0.21319,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-1527","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.24.0"],"state":"fixed","available":[{"version":"6.24.0","date":"2026-03-14","kind":"first-observed"}]},"advisories":[],"risk":0.13776000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-1527","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1527","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq","https://hackerone.com/reports/3487198"],"description":"ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\\r\\n) to:\n\n  *  Inject arbitrary HTTP headers\n  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\nThe vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:\n\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n  header += `connection: upgrade\\r\\nupgrade: ${upgrade}\\r\\n`\n}","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.6,"exploitabilityScore":2.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-1527","epss":0.00287,"percentile":0.21319,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-1527","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-4992-7rv2-5pvq","versionConstraint":"<6.24.0 (semantic)"},"fix":{"suggestedVersion":"6.24.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2m5v-pch6-74hx","dataSource":"https://github.com/advisories/GHSA-2m5v-pch6-74hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx","https://nvd.nist.gov/vuln/detail/CVE-2026-109383","https://github.com/nodejs/undici/commit/04cb74b1db131ff8f5b4557dce811cbf5f4664b4","https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f","https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109383","epss":0.00184,"percentile":0.08023,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109383","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.29.1"],"state":"fixed","available":[{"version":"6.29.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.13707999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-109383","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"],"description":"undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109383","epss":0.00184,"percentile":0.08023,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109383","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-2m5v-pch6-74hx","versionConstraint":">=4.0.0,<6.29.1 (semantic)"},"fix":{"suggestedVersion":"6.29.1"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-v3r7-h72x-cjcm","dataSource":"https://github.com/advisories/GHSA-v3r7-h72x-cjcm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm","https://nvd.nist.gov/vuln/detail/CVE-2026-16729","https://github.com/nodejs/undici/commit/10d93fc332f2c8c161982dec3833201de29891b5","https://github.com/nodejs/undici/commit/3bf91ddb493e853957f3a58e155326a668ab8aef","https://github.com/nodejs/undici/commit/af7484043ee075a6f216da0ad77e1dac55199235","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.0","https://github.com/nodejs/undici/releases/tag/v7.29.0","https://github.com/nodejs/undici/releases/tag/v8.9.0"],"description":"undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16729","epss":0.00278,"percentile":0.20316,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16729","cwe":"CWE-74","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.28.0"],"state":"fixed","available":[{"version":"6.28.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.13622},"relatedVulnerabilities":[{"id":"CVE-2026-16729","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16729","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm"],"description":"undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16729","epss":0.00278,"percentile":0.20316,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16729","cwe":"CWE-74","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-v3r7-h72x-cjcm","versionConstraint":"<6.28.0 (semantic)"},"fix":{"suggestedVersion":"6.28.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2qvq-rjwj-gvw9","dataSource":"https://github.com/advisories/GHSA-2qvq-rjwj-gvw9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9","https://nvd.nist.gov/vuln/detail/CVE-2021-23369","https://nvd.nist.gov/vuln/detail/CVE-2021-23383","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33916"],"description":"Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33916","epss":0.0028,"percentile":0.20536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33916","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33916","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.1358},"relatedVulnerabilities":[{"id":"CVE-2026-33916","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33916","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype  pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates  and reduces the attack surface.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33916","epss":0.0028,"percentile":0.20536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33916","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33916","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-2qvq-rjwj-gvw9","versionConstraint":">=4.0.0,<4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-gh4j-gqv2-49f6","dataSource":"https://github.com/advisories/GHSA-gh4j-gqv2-49f6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6","https://nvd.nist.gov/vuln/detail/CVE-2026-41650","https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.6.0"],"description":"fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41650","epss":0.00238,"percentile":0.14938,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41650","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.7.0"],"state":"fixed","available":[{"version":"5.7.0","date":"2026-04-23","kind":"first-observed"}]},"advisories":[],"risk":0.13208999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41650","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41650","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.6.0","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6"],"description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"-->\" sequence in comment content or the \"]]>\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41650","epss":0.00238,"percentile":0.14938,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41650","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-xml-parser","version":"4.2.5"}},"found":{"vulnerabilityID":"GHSA-gh4j-gqv2-49f6","versionConstraint":"<5.7.0 (semantic)"},"fix":{"suggestedVersion":"5.7.0"}}],"artifact":{"id":"pkg:npm/fast-xml-parser@4.2.5?package-id=7b31b6b780a1a92a","name":"fast-xml-parser","version":"4.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:naturalintelligence:fast-xml-parser:4.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/fast-xml-parser@4.2.5","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5025","dataSource":"https://go.dev/issue/79571","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781700"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42506","epss":0.00235,"percentile":0.1457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42506","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.13042499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-42506","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42506","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781700","https://go.dev/issue/79571","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5025"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42506","epss":0.00235,"percentile":0.1457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42506","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-5025","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-685w-q87j-wqw3","dataSource":"https://github.com/advisories/GHSA-685w-q87j-wqw3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3","https://nvd.nist.gov/vuln/detail/CVE-2026-85747","https://github.com/distribution/distribution/commit/8f91c26c8888a95a36c2357a6e30bc15d4dd76d3","https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2"],"description":"Distribution: Client `manifests.Get()` does not verify returned content against requested digest","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.12861999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-85747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85747","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2","https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3"],"description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/distribution","version":"v2.8.3+incompatible"}},"found":{"vulnerabilityID":"GHSA-685w-q87j-wqw3","versionConstraint":"<=2.8.3 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible?package-id=3ecf5daaa007448a","name":"github.com/docker/distribution","version":"v2.8.3+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:distribution:v2.8.3\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk="}}},{"vulnerability":{"id":"GHSA-59jp-pj84-45mr","dataSource":"https://github.com/advisories/GHSA-59jp-pj84-45mr","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr","https://nvd.nist.gov/vuln/detail/CVE-2026-22772","https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d"],"description":"Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22772","epss":0.00232,"percentile":0.14085,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22772","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.8.5"],"state":"fixed","available":[{"version":"1.8.5","date":"2026-01-14","kind":"first-observed"}]},"advisories":[],"risk":0.12528},"relatedVulnerabilities":[{"id":"CVE-2026-22772","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22772","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d","https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr"],"description":"Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22772","epss":0.00232,"percentile":0.14085,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22772","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/fulcio","version":"v1.6.5"}},"found":{"vulnerabilityID":"GHSA-59jp-pj84-45mr","versionConstraint":"<=1.8.4 (go)"},"fix":{"suggestedVersion":"1.8.5"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/fulcio@v1.6.5?package-id=1ac9dab65467ecb3","name":"github.com/sigstore/fulcio","version":"v1.6.5","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:fulcio:v1.6.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/fulcio@v1.6.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:A9DtV2hmeJ835mtqqxgvV0Sie0HOPKaLPgvFVF4FU7c="}}},{"vulnerability":{"id":"GO-2026-5694","dataSource":"https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6","namespace":"govulndb:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39395"],"description":"Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39395","epss":0.00241,"percentile":0.15239,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39395","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.3"],"state":"fixed","available":[{"version":"2.6.3","date":"2026-04-06","kind":"release"}]},"advisories":[],"risk":0.12411499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-39395","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39395","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6"],"description":"Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a \"Verified OK\" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39395","epss":0.00241,"percentile":0.15239,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39395","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-w6c6-c85g-mmv6","dataSource":"https://github.com/advisories/GHSA-w6c6-c85g-mmv6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6","https://nvd.nist.gov/vuln/detail/CVE-2026-39395"],"description":"Cosign's verify-blob-attestation reports false positive when payload parsing fails","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39395","epss":0.00241,"percentile":0.15239,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39395","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/sigstore/cosign/v2","version":"v2.4.1"}},"found":{"vulnerabilityID":"GO-2026-5694","versionConstraint":"<2.6.3 (go)"},"fix":{"suggestedVersion":"2.6.3"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/cosign/v2@v2.4.1?package-id=5bddba28de790ab9","name":"github.com/sigstore/cosign/v2","version":"v2.4.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:cosign\\/v2:v2.4.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/cosign/v2@v2.4.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:b8UXEfJFks3hmTwyxrRNrn6racpmccUycBHxDMkEPvU="}}},{"vulnerability":{"id":"GO-2026-5027","dataSource":"https://go.dev/issue/79572","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781701"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42502","epss":0.00223,"percentile":0.12987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42502","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-42502","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781701","https://go.dev/issue/79572","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5027"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42502","epss":0.00223,"percentile":0.12987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42502","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-5027","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GO-2026-5029","dataSource":"https://go.dev/issue/79574","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781703"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25681","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25681","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-25681","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781703","https://go.dev/issue/79574","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5029"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25681","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25681","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-5029","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GO-2026-5030","dataSource":"https://go.dev/issue/79575","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781685"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27136","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27136","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-27136","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781685","https://go.dev/issue/79575","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5030"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27136","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27136","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-5030","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-m8rv-5g2x-5cg5","dataSource":"https://github.com/advisories/GHSA-m8rv-5g2x-5cg5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5","https://nvd.nist.gov/vuln/detail/CVE-2026-15157","https://github.com/nodejs/undici/commit/33928bc24f742ea8422ed90d17f2e0cc83e4d09d","https://github.com/nodejs/undici/commit/740a0b7c173cb4a83a5b693e96e8f3a116cfc400","https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77f951348f4e5c847b7b42","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.0","https://github.com/nodejs/undici/releases/tag/v7.29.0","https://github.com/nodejs/undici/releases/tag/v8.9.0"],"description":"undici vulnerable to CRLF Injection via blob-like body 'type' property","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-15157","epss":0.00261,"percentile":0.17982,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-15157","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.28.0"],"state":"fixed","available":[{"version":"6.28.0","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.12006},"relatedVulnerabilities":[{"id":"CVE-2026-15157","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15157","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5"],"description":"undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-15157","epss":0.00261,"percentile":0.17982,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-15157","cwe":"CWE-93","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-m8rv-5g2x-5cg5","versionConstraint":"<6.28.0 (semantic)"},"fix":{"suggestedVersion":"6.28.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-fphv-w9fq-2525","dataSource":"https://github.com/advisories/GHSA-fphv-w9fq-2525","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-fphv-w9fq-2525","https://github.com/theupdateframework/go-tuf/commit/b38d91fdbc69dfe31fe9230d97dafe527ea854a0","https://github.com/theupdateframework/go-tuf/releases/tag/v2.3.1","https://nvd.nist.gov/vuln/detail/CVE-2026-23992"],"description":"go-tuf improperly validates the configured threshold for delegations","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23992","epss":0.00215,"percentile":0.11901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23992","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.1"],"state":"fixed","available":[{"version":"2.3.1","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.117175},"relatedVulnerabilities":[{"id":"CVE-2026-23992","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23992","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/theupdateframework/go-tuf/commit/b38d91fdbc69dfe31fe9230d97dafe527ea854a0","https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-fphv-w9fq-2525"],"description":"go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23992","epss":0.00215,"percentile":0.11901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23992","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/theupdateframework/go-tuf/v2","version":"v2.0.1"}},"found":{"vulnerabilityID":"GHSA-fphv-w9fq-2525","versionConstraint":"<2.3.1 (go)"},"fix":{"suggestedVersion":"2.3.1"}}],"artifact":{"id":"pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.0.1?package-id=aeb556b4fec7e449","name":"github.com/theupdateframework/go-tuf/v2","version":"v2.0.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:theupdateframework:go-tuf\\/v2:v2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:theupdateframework:go_tuf\\/v2:v2.0.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.0.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:11p9tXpq10KQEujxjcIjDSivMKCMLguls7erXHZnxJQ="}}},{"vulnerability":{"id":"GHSA-jqc5-w2xx-5vq4","dataSource":"https://github.com/advisories/GHSA-jqc5-w2xx-5vq4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-jqc5-w2xx-5vq4","https://github.com/theupdateframework/go-tuf/commit/d361e2ea24e427581343dee5c7a32b485d79fcc0","https://nvd.nist.gov/vuln/detail/CVE-2026-24686"],"description":"go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24686","epss":0.00231,"percentile":0.14048,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24686","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.4.1"],"state":"fixed","available":[{"version":"2.4.1","date":"2026-01-27","kind":"first-observed"}]},"advisories":[],"risk":0.112035},"relatedVulnerabilities":[{"id":"CVE-2026-24686","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24686","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/theupdateframework/go-tuf/commit/d361e2ea24e427581343dee5c7a32b485d79fcc0","https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-jqc5-w2xx-5vq4"],"description":"go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24686","epss":0.00231,"percentile":0.14048,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24686","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/theupdateframework/go-tuf/v2","version":"v2.0.1"}},"found":{"vulnerabilityID":"GHSA-jqc5-w2xx-5vq4","versionConstraint":"<2.4.1 (go)"},"fix":{"suggestedVersion":"2.4.1"}}],"artifact":{"id":"pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.0.1?package-id=aeb556b4fec7e449","name":"github.com/theupdateframework/go-tuf/v2","version":"v2.0.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:theupdateframework:go-tuf\\/v2:v2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:theupdateframework:go_tuf\\/v2:v2.0.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.0.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:11p9tXpq10KQEujxjcIjDSivMKCMLguls7erXHZnxJQ="}}},{"vulnerability":{"id":"GHSA-r53p-7pc4-xj5r","dataSource":"https://github.com/advisories/GHSA-r53p-7pc4-xj5r","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","https://nvd.nist.gov/vuln/detail/CVE-2026-18540","https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329","https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95","https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548","https://hackerone.com/reports/3900104","https://hackerone.com/reports/3900615","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to downstream response splitting via retry interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18540","epss":0.00309,"percentile":0.23786,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.28.1"],"state":"fixed","available":[{"version":"6.28.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.10351499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-18540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"],"description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18540","epss":0.00309,"percentile":0.23786,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-r53p-7pc4-xj5r","versionConstraint":"<6.28.1 (semantic)"},"fix":{"suggestedVersion":"6.28.1"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6hxr-mr5r-9836","dataSource":"https://github.com/advisories/GHSA-6hxr-mr5r-9836","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836","https://nvd.nist.gov/vuln/detail/CVE-2026-68499","https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d","https://github.com/uhop/node-re2/releases/tag/1.25.2"],"description":"re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-68499","epss":0.00184,"percentile":0.07968,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-68499","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.25.2"],"state":"fixed","available":[{"version":"1.25.2","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.10304},"relatedVulnerabilities":[{"id":"CVE-2026-68499","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-68499","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d","https://github.com/uhop/node-re2/releases/tag/1.25.2","https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836"],"description":"re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded native memory growth that blocks the event loop and can exhaust host memory. This issue is fixed in 1.25.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-68499","epss":0.00184,"percentile":0.07968,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-68499","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"re2","version":"1.20.11"}},"found":{"vulnerabilityID":"GHSA-6hxr-mr5r-9836","versionConstraint":"<=1.25.1 (semantic)"},"fix":{"suggestedVersion":"1.25.2"}}],"artifact":{"id":"pkg:npm/re2@1.20.11?package-id=eb24e7672cea176f","name":"re2","version":"1.20.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:re2:re2:1.20.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/re2@1.20.11","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6179","dataSource":"https://go.dev/issue/80744","namespace":"govulndb:language:go","severity":"High","urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814960","https://go.dev/cl/815020"],"description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.\n\nThis attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.\n\nAll tiles are now correctly verified against their parents.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56865","epss":0.00129,"percentile":0.02529,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.40.0"],"state":"fixed","available":[{"version":"0.40.0","date":"2026-08-13","kind":"release"}]},"advisories":[],"risk":0.10255500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-56865","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56865","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/814960","https://go.dev/cl/815020","https://go.dev/issue/80744","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6179"],"description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56865","epss":0.00129,"percentile":0.02529,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/mod","version":"v0.25.0"}},"found":{"vulnerabilityID":"GO-2026-6179","versionConstraint":"<0.40.0 (go)"},"fix":{"suggestedVersion":"0.40.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/mod@v0.25.0?package-id=7087f966620d102b","name":"golang.org/x/mod","version":"v0.25.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:x\\/mod:v0.25.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/mod@v0.25.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w="}}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-vwc7-r8mq-g2x9","dataSource":"https://github.com/advisories/GHSA-vwc7-r8mq-g2x9","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-76845","https://github.com/cthackers/adm-zip","https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js","https://www.vulncheck.com/advisories/adm-zip-through-arbitrary-file-overwrite-via-symlink-following-on-extraction","https://github.com/cthackers/adm-zip/issues/574","https://github.com/cthackers/adm-zip/pull/575"],"description":"adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76845","epss":0.00171,"percentile":0.06437,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76845","cwe":"CWE-59","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.09960749999999999},"relatedVulnerabilities":[{"id":"CVE-2026-76845","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76845","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/cthackers/adm-zip","https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js","https://www.vulncheck.com/advisories/adm-zip-through-arbitrary-file-overwrite-via-symlink-following-on-extraction"],"description":"adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, \"w\", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76845","epss":0.00171,"percentile":0.06437,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76845","cwe":"CWE-59","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"adm-zip","version":"0.5.12"}},"found":{"vulnerabilityID":"GHSA-vwc7-r8mq-g2x9","versionConstraint":">=0.5.9,<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/adm-zip@0.5.12?package-id=12e43dec75aa588f","name":"adm-zip","version":"0.5.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adm-zip_project:adm-zip:0.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/adm-zip@0.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-9vcr-p3rj-q5q6","dataSource":"https://github.com/advisories/GHSA-9vcr-p3rj-q5q6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6","https://nvd.nist.gov/vuln/detail/CVE-2026-49834","https://github.com/sigstore/sigstore-go/pull/633","https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207","https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0"],"description":"sigstore-go has a multi-log threshold bypass via single compromised log","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49834","epss":0.00181,"percentile":0.07667,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49834","cwe":"CWE-347","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.2.0"],"state":"fixed","available":[{"version":"1.2.0","date":"2026-07-10","kind":"first-observed"}]},"advisories":[],"risk":0.09864500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-49834","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49834","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207","https://github.com/sigstore/sigstore-go/pull/633","https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0","https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6"],"description":"sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49834","epss":0.00181,"percentile":0.07667,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49834","cwe":"CWE-347","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/sigstore-go","version":"v0.6.2"}},"found":{"vulnerabilityID":"GHSA-9vcr-p3rj-q5q6","versionConstraint":"<=1.1.4 (go)"},"fix":{"suggestedVersion":"1.2.0"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/sigstore-go@v0.6.2?package-id=4f677ba5bd5c0a53","name":"github.com/sigstore/sigstore-go","version":"v0.6.2","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:sigstore-go:v0.6.2:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:sigstore_go:v0.6.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/sigstore-go@v0.6.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:8uiywjt73vzfrGfWYVwVsiB1E1Qmwmpgr1kVpl4fs6A="}}},{"vulnerability":{"id":"GHSA-vmf3-w455-68vh","dataSource":"https://github.com/advisories/GHSA-vmf3-w455-68vh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.16"],"state":"fixed","available":[{"version":"7.5.16","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.09281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53655","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-vmf3-w455-68vh","versionConstraint":"<=7.5.15 (semantic)"},"fix":{"suggestedVersion":"7.5.16"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.38.0?package-id=5b5eb57ce0ab97b5","name":"golang.org/x/net","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.38.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.38.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8="}}},{"vulnerability":{"id":"GHSA-8hcv-x26h-mcgp","dataSource":"https://github.com/advisories/GHSA-8hcv-x26h-mcgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp"],"description":"node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71430","epss":0.00157,"percentile":0.0486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71430","cwe":"CWE-617","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.25.1"],"state":"fixed","available":[{"version":"1.25.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.08792000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-71430","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71430","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp"],"description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71430","epss":0.00157,"percentile":0.0486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71430","cwe":"CWE-617","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"re2","version":"1.20.11"}},"found":{"vulnerabilityID":"GHSA-8hcv-x26h-mcgp","versionConstraint":"<=1.25.0 (semantic)"},"fix":{"suggestedVersion":"1.25.1"}}],"artifact":{"id":"pkg:npm/re2@1.20.11?package-id=eb24e7672cea176f","name":"re2","version":"1.20.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:re2:re2:1.20.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/re2@1.20.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-j4r3-hg7j-8chg","dataSource":"https://github.com/advisories/GHSA-j4r3-hg7j-8chg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg","https://github.com/uhop/node-re2/issues/272","https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4"],"description":"node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"exploitabilityScore":2.6,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71498","epss":0.00174,"percentile":0.06812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71498","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.26.1"],"state":"fixed","available":[{"version":"1.26.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.08787},"relatedVulnerabilities":[{"id":"CVE-2026-71498","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71498","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/uhop/node-re2/commit/9d72042a6a0da5bc523908b04808ea0e23867cc4","https://github.com/uhop/node-re2/issues/272","https://github.com/uhop/node-re2/security/advisories/GHSA-j4r3-hg7j-8chg"],"description":"node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"exploitabilityScore":2.6,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71498","epss":0.00174,"percentile":0.06812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71498","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"re2","version":"1.20.11"}},"found":{"vulnerabilityID":"GHSA-j4r3-hg7j-8chg","versionConstraint":"<=1.26.0 (semantic)"},"fix":{"suggestedVersion":"1.26.1"}}],"artifact":{"id":"pkg:npm/re2@1.20.11?package-id=eb24e7672cea176f","name":"re2","version":"1.20.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:re2:re2:1.20.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/re2@1.20.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-ff84-5f28-78qj","dataSource":"https://github.com/advisories/GHSA-ff84-5f28-78qj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj","https://nvd.nist.gov/vuln/detail/CVE-2026-67550","https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d","https://github.com/uhop/node-re2/releases/tag/1.25.2"],"description":"re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.7,"exploitabilityScore":1.5,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67550","epss":0.00161,"percentile":0.05287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67550","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.25.2"],"state":"fixed","available":[{"version":"1.25.2","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.086135},"relatedVulnerabilities":[{"id":"CVE-2026-67550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d","https://github.com/uhop/node-re2/releases/tag/1.25.2","https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj"],"description":"re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.7,"exploitabilityScore":1.5,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67550","epss":0.00161,"percentile":0.05287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67550","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"re2","version":"1.20.11"}},"found":{"vulnerabilityID":"GHSA-ff84-5f28-78qj","versionConstraint":"<=1.25.1 (semantic)"},"fix":{"suggestedVersion":"1.25.2"}}],"artifact":{"id":"pkg:npm/re2@1.20.11?package-id=eb24e7672cea176f","name":"re2","version":"1.20.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:re2:re2:1.20.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/re2@1.20.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-g8m3-5g58-fq7m","dataSource":"https://github.com/advisories/GHSA-g8m3-5g58-fq7m","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m","https://nvd.nist.gov/vuln/detail/CVE-2026-11525","https://cna.openjsf.org/security-advisories.html"],"description":"undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-11525","epss":0.00238,"percentile":0.14959,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-11525","cwe":"CWE-183","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.27.0"],"state":"fixed","available":[{"version":"6.27.0","date":"2026-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.07973000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-11525","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11525","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m"],"description":"Impact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.\n\nThis was introduced in undici 5.15.0 when the cookies feature was added.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nAfter parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-11525","epss":0.00238,"percentile":0.14959,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-11525","cwe":"CWE-183","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-g8m3-5g58-fq7m","versionConstraint":"<6.27.0 (semantic)"},"fix":{"suggestedVersion":"6.27.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-35p6-xmwp-9g52","dataSource":"https://github.com/advisories/GHSA-35p6-xmwp-9g52","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52","https://nvd.nist.gov/vuln/detail/CVE-2026-6733","https://hackerone.com/reports/3582376","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/commit/6ea54ef8c4051e95bb68c89d4a5c9274fe6fbb4b","https://github.com/nodejs/undici/releases/tag/v6.27.0","https://github.com/nodejs/undici/releases/tag/v7.28.0","https://github.com/nodejs/undici/releases/tag/v8.5.0"],"description":"undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6733","epss":0.0022,"percentile":0.12538,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6733","cwe":"CWE-367","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["6.27.0"],"state":"fixed","available":[{"version":"6.27.0","date":"2026-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.07369999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-6733","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6733","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52","https://hackerone.com/reports/3582376"],"description":"Impact:\nUndici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nDisable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6733","epss":0.0022,"percentile":0.12538,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6733","cwe":"CWE-367","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"5.29.0"}},"found":{"vulnerabilityID":"GHSA-35p6-xmwp-9g52","versionConstraint":"<6.27.0 (semantic)"},"fix":{"suggestedVersion":"6.27.0"}}],"artifact":{"id":"pkg:npm/undici@5.29.0?package-id=76b22366355fbfee","name":"undici","version":"5.29.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:5.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@5.29.0","upstreams":[]}},{"vulnerability":{"id":"GO-2026-4529","dataSource":"https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm","namespace":"govulndb:language:go","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24122","https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e","https://github.com/sigstore/cosign/releases/tag/v3.0.5"],"description":"Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24122","epss":0.00215,"percentile":0.11984,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24122","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.07202499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-24122","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24122","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e","https://github.com/sigstore/cosign/releases/tag/v3.0.5","https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm"],"description":"Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24122","epss":0.00215,"percentile":0.11984,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24122","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-wfqv-66vq-46rm","dataSource":"https://github.com/advisories/GHSA-wfqv-66vq-46rm","namespace":"github:language:go","severity":"Low","urls":["https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm","https://nvd.nist.gov/vuln/detail/CVE-2026-24122","https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e","https://github.com/sigstore/cosign/releases/tag/v3.0.5"],"description":"Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24122","epss":0.00215,"percentile":0.11984,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24122","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/sigstore/cosign/v2","version":"v2.4.1"}},"found":{"vulnerabilityID":"GO-2026-4529","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/cosign/v2@v2.4.1?package-id=5bddba28de790ab9","name":"github.com/sigstore/cosign/v2","version":"v2.4.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:cosign\\/v2:v2.4.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/cosign/v2@v2.4.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:b8UXEfJFks3hmTwyxrRNrn6racpmccUycBHxDMkEPvU="}}},{"vulnerability":{"id":"GHSA-whqx-f9j3-ch6m","dataSource":"https://github.com/advisories/GHSA-whqx-f9j3-ch6m","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m","https://nvd.nist.gov/vuln/detail/CVE-2026-22703","https://github.com/sigstore/cosign/pull/4623","https://github.com/sigstore/cosign/commit/6832fba4928c1ad69400235bbc41212de5006176"],"description":"Cosign verification accepts any valid Rekor entry under certain conditions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22703","epss":0.00106,"percentile":0.01103,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22703","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.2"],"state":"fixed","available":[{"version":"2.6.2","date":"2026-01-14","kind":"first-observed"}]},"advisories":[],"risk":0.055650000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-22703","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22703","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/cosign/commit/6832fba4928c1ad69400235bbc41212de5006176","https://github.com/sigstore/cosign/pull/4623","https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m"],"description":"Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22703","epss":0.00106,"percentile":0.01103,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22703","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/cosign/v2","version":"v2.4.1"}},"found":{"vulnerabilityID":"GHSA-whqx-f9j3-ch6m","versionConstraint":"<=2.6.1 (go)"},"fix":{"suggestedVersion":"2.6.2"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/cosign/v2@v2.4.1?package-id=5bddba28de790ab9","name":"github.com/sigstore/cosign/v2","version":"v2.4.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:cosign\\/v2:v2.4.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/cosign/v2@v2.4.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:b8UXEfJFks3hmTwyxrRNrn6racpmccUycBHxDMkEPvU="}}},{"vulnerability":{"id":"GO-2026-5763","dataSource":"https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3","namespace":"govulndb:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39984","https://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6"],"description":"Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39984","epss":0.00099,"percentile":0.00795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39984","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.051975},"relatedVulnerabilities":[{"id":"CVE-2026-39984","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39984","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6","https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3"],"description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39984","epss":0.00099,"percentile":0.00795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39984","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-xm5m-wgh2-rrg3","dataSource":"https://github.com/advisories/GHSA-xm5m-wgh2-rrg3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3","https://nvd.nist.gov/vuln/detail/CVE-2026-39984","https://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6"],"description":"Sigstore Timestamp Authority has Improper Certificate Validation in verifier","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39984","epss":0.00099,"percentile":0.00795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39984","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/sigstore/timestamp-authority","version":"v1.2.2"}},"found":{"vulnerabilityID":"GO-2026-5763","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2?package-id=f89b0bf61be9ed87","name":"github.com/sigstore/timestamp-authority","version":"v1.2.2","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:timestamp-authority:v1.2.2:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:timestamp_authority:v1.2.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/timestamp-authority@v1.2.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4qyutnCQqJ0apMewFyx+3t7Tws00JQ/JonBiu3QvLE="}}},{"vulnerability":{"id":"GHSA-wqqc-jjcq-vfxm","dataSource":"https://github.com/advisories/GHSA-wqqc-jjcq-vfxm","namespace":"github:language:go","severity":"Low","urls":["https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm","https://github.com/sigstore/sigstore-go/pull/642","https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f","https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"],"description":"sigstore-go fails to check signature timestamps against a signing key's validity period","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54787","epss":0.00134,"percentile":0.02858,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54787","cwe":"CWE-324","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.2.1"],"state":"fixed","available":[{"version":"1.2.1","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.040870000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-54787","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54787","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f","https://github.com/sigstore/sigstore-go/pull/642","https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1","https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"],"description":"sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54787","epss":0.00134,"percentile":0.02858,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54787","cwe":"CWE-324","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/sigstore-go","version":"v0.6.2"}},"found":{"vulnerabilityID":"GHSA-wqqc-jjcq-vfxm","versionConstraint":"<=1.2.0 (go)"},"fix":{"suggestedVersion":"1.2.1"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/sigstore-go@v0.6.2?package-id=4f677ba5bd5c0a53","name":"github.com/sigstore/sigstore-go","version":"v0.6.2","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:sigstore-go:v0.6.2:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:sigstore_go:v0.6.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/sigstore-go@v0.6.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:8uiywjt73vzfrGfWYVwVsiB1E1Qmwmpgr1kVpl4fs6A="}}},{"vulnerability":{"id":"GO-2026-5024","dataSource":"https://go.dev/issue/78916","namespace":"govulndb:language:go","severity":"Low","urls":["https://go.dev/cl/770080","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"],"description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39824","epss":0.00114,"percentile":0.01458,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.44.0"],"state":"fixed","available":[{"version":"0.44.0","date":"2026-04-23","kind":"release"}]},"advisories":[],"risk":0.03591},"relatedVulnerabilities":[{"id":"CVE-2026-39824","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39824","namespace":"nvd:cpe","severity":"Low","urls":["https://go.dev/cl/770080","https://go.dev/issue/78916","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg","https://pkg.go.dev/vuln/GO-2026-5024"],"description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39824","epss":0.00114,"percentile":0.01458,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/sys","version":"v0.31.0"}},"found":{"vulnerabilityID":"GO-2026-5024","versionConstraint":"<0.44.0 (go)"},"fix":{"suggestedVersion":"0.44.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/sys@v0.31.0?package-id=99f26aff570eb118","name":"golang.org/x/sys","version":"v0.31.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:x\\/sys:v0.31.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/sys@v0.31.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik="}}},{"vulnerability":{"id":"GHSA-8238-w5pm-2374","dataSource":"https://github.com/advisories/GHSA-8238-w5pm-2374","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-8238-w5pm-2374","https://github.com/cthackers/adm-zip/commit/5e70d3a26097d68fa981c41f022c053117174e49","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"],"description":"adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["0.6.1"],"state":"fixed","available":[{"version":"0.6.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"adm-zip","version":"0.5.12"}},"found":{"vulnerabilityID":"GHSA-8238-w5pm-2374","versionConstraint":"<=0.6.0 (semantic)"},"fix":{"suggestedVersion":"0.6.1"}}],"artifact":{"id":"pkg:npm/adm-zip@0.5.12?package-id=12e43dec75aa588f","name":"adm-zip","version":"0.5.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adm-zip_project:adm-zip:0.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/adm-zip@0.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-rcw4-f5rp-g42v","dataSource":"https://github.com/advisories/GHSA-rcw4-f5rp-g42v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v","https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"],"description":"adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["0.6.1"],"state":"fixed","available":[{"version":"0.6.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"adm-zip","version":"0.5.12"}},"found":{"vulnerabilityID":"GHSA-rcw4-f5rp-g42v","versionConstraint":"<=0.6.0 (semantic)"},"fix":{"suggestedVersion":"0.6.1"}}],"artifact":{"id":"pkg:npm/adm-zip@0.5.12?package-id=12e43dec75aa588f","name":"adm-zip","version":"0.5.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adm-zip_project:adm-zip:0.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/adm-zip@0.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrxh-6v49-42gf","dataSource":"https://github.com/advisories/GHSA-hrxh-6v49-42gf","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf","https://github.com/grpc/grpc-go/pull/9236","https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935","https://github.com/grpc/grpc-go/releases/tag/v1.82.1"],"description":"gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"vendorMetadata":{}}],"fix":{"versions":["1.82.1"],"state":"fixed","available":[{"version":"1.82.1","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.69.4"}},"found":{"vulnerabilityID":"GHSA-hrxh-6v49-42gf","versionConstraint":"<1.82.1 (go)"},"fix":{"suggestedVersion":"1.82.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.69.4?package-id=1f850ee01658c705","name":"google.golang.org/grpc","version":"v1.69.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.69.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.69.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A="}}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.15.1"],"state":"fixed","available":[{"version":"3.15.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=3.0.0,<3.15.1 (semantic)"},"fix":{"suggestedVersion":"3.15.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=c9ca33406d6c0fb3","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=c6c6a08d466512f1","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0bee311501151095","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/actions/installer/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/js-yaml@4.1.0?package-id=0027c1be54e9cf42","name":"js-yaml","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"description":"Zod can exhaust memory while validating oversized constrained collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"fix":{"versions":["4.6.6"],"state":"fixed","available":[{"version":"4.6.6","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2023-54404","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","namespace":"nvd:cpe","severity":"Unknown","urls":[],"description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"zod","version":"3.23.8"}},"found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"fix":{"suggestedVersion":"4.6.6"}}],"artifact":{"id":"pkg:npm/zod@3.23.8?package-id=87b5178ed0558ac6","name":"zod","version":"3.23.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:zod:zod:3.23.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/zod@3.23.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-c6fg-446q-cg94","dataSource":"https://github.com/advisories/GHSA-c6fg-446q-cg94","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-c6fg-446q-cg94","https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"],"description":"adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["0.6.1"],"state":"fixed","available":[{"version":"0.6.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"adm-zip","version":"0.5.12"}},"found":{"vulnerabilityID":"GHSA-c6fg-446q-cg94","versionConstraint":"<=0.6.0 (semantic)"},"fix":{"suggestedVersion":"0.6.1"}}],"artifact":{"id":"pkg:npm/adm-zip@0.5.12?package-id=12e43dec75aa588f","name":"adm-zip","version":"0.5.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adm-zip_project:adm-zip:0.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/adm-zip@0.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-p634-w6r4-rjp2","dataSource":"https://github.com/advisories/GHSA-p634-w6r4-rjp2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/cthackers/adm-zip/security/advisories/GHSA-p634-w6r4-rjp2","https://github.com/cthackers/adm-zip/commit/05101d47b3b983b705cc3e66fc34366118ba7b99","https://github.com/cthackers/adm-zip/releases/tag/v0.6.1"],"description":"adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["0.6.1"],"state":"fixed","available":[{"version":"0.6.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"adm-zip","version":"0.5.12"}},"found":{"vulnerabilityID":"GHSA-p634-w6r4-rjp2","versionConstraint":"<=0.6.0 (semantic)"},"fix":{"suggestedVersion":"0.6.1"}}],"artifact":{"id":"pkg:npm/adm-zip@0.5.12?package-id=12e43dec75aa588f","name":"adm-zip","version":"0.5.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adm-zip_project:adm-zip:0.5.12:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/adm-zip@0.5.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-pmwq-pjrm-6p5r","dataSource":"https://github.com/advisories/GHSA-pmwq-pjrm-6p5r","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-pmwq-pjrm-6p5r","https://github.com/in-toto/in-toto-golang/pull/462","https://github.com/in-toto/in-toto-golang/commit/36d782ffb2ca3adbffcdce1fd971c23319dd4469"],"description":"in-toto-golang and in-toto-python have inconsistent negation behavior","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.1,"exploitabilityScore":0.5,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["0.11.0"],"state":"fixed","available":[{"version":"0.11.0","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/in-toto/in-toto-golang","version":"v0.9.0"}},"found":{"vulnerabilityID":"GHSA-pmwq-pjrm-6p5r","versionConstraint":"<0.11.0 (go)"},"fix":{"suggestedVersion":"0.11.0"}}],"artifact":{"id":"pkg:golang/github.com/in-toto/in-toto-golang@v0.9.0?package-id=759dde9726d051ea","name":"github.com/in-toto/in-toto-golang","version":"v0.9.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:in-toto:in-toto-golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in-toto:in_toto_golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in_toto:in-toto-golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in_toto:in_toto_golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in:in-toto-golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in:in_toto_golang:v0.9.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/in-toto/in-toto-golang@v0.9.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU="}}},{"vulnerability":{"id":"GHSA-7rx3-28cr-v5wh","dataSource":"https://github.com/advisories/GHSA-7rx3-28cr-v5wh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh","https://github.com/advisories/GHSA-765h-qjxv-5f44","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"],"description":"Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-7rx3-28cr-v5wh","versionConstraint":">=4.6.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-253c-mchw-3w2r","dataSource":"https://github.com/advisories/GHSA-253c-mchw-3w2r","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49"],"description":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"fix":{"versions":["14.3.1"],"state":"fixed","available":[{"version":"14.3.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"14.1.0"}},"found":{"vulnerabilityID":"GHSA-253c-mchw-3w2r","versionConstraint":"<14.3.1 (semantic)"},"fix":{"suggestedVersion":"14.3.1"}}],"artifact":{"id":"pkg:npm/markdown-it@14.1.0?package-id=153988745b47afba","name":"markdown-it","version":"14.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:14.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@14.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-36j9-mx87-2cff","dataSource":"https://github.com/advisories/GHSA-36j9-mx87-2cff","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/renovatebot/renovate/security/advisories/GHSA-36j9-mx87-2cff"],"description":"Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["40.33.0"],"state":"fixed","available":[{"version":"40.33.0","date":"2026-01-14","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"renovate","version":"37.374.1"}},"found":{"vulnerabilityID":"GHSA-36j9-mx87-2cff","versionConstraint":">=32.135.0,<40.33.0 (semantic)"},"fix":{"suggestedVersion":"40.33.0"}}],"artifact":{"id":"pkg:npm/renovate@37.374.1?package-id=7601ded5d9878714","name":"renovate","version":"37.374.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["AGPL-3.0-only"],"cpes":["cpe:2.3:a:renovate:renovate:37.374.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/renovate@37.374.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3f44-xw83-3pmg","dataSource":"https://github.com/advisories/GHSA-3f44-xw83-3pmg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/renovatebot/renovate/security/advisories/GHSA-3f44-xw83-3pmg"],"description":"Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["40.33.0"],"state":"fixed","available":[{"version":"40.33.0","date":"2026-01-14","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"renovate","version":"37.374.1"}},"found":{"vulnerabilityID":"GHSA-3f44-xw83-3pmg","versionConstraint":">=31.51.0,<40.33.0 (semantic)"},"fix":{"suggestedVersion":"40.33.0"}}],"artifact":{"id":"pkg:npm/renovate@37.374.1?package-id=7601ded5d9878714","name":"renovate","version":"37.374.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["AGPL-3.0-only"],"cpes":["cpe:2.3:a:renovate:renovate:37.374.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/renovate@37.374.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-fr4j-65pv-gjjj","dataSource":"https://github.com/advisories/GHSA-fr4j-65pv-gjjj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/renovatebot/renovate/security/advisories/GHSA-fr4j-65pv-gjjj"],"description":"Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["40.33.0"],"state":"fixed","available":[{"version":"40.33.0","date":"2026-01-14","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"renovate","version":"37.374.1"}},"found":{"vulnerabilityID":"GHSA-fr4j-65pv-gjjj","versionConstraint":">=35.63.0,<40.33.0 (semantic)"},"fix":{"suggestedVersion":"40.33.0"}}],"artifact":{"id":"pkg:npm/renovate@37.374.1?package-id=7601ded5d9878714","name":"renovate","version":"37.374.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["AGPL-3.0-only"],"cpes":["cpe:2.3:a:renovate:renovate:37.374.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/renovate@37.374.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-pfq2-hh62-7m96","dataSource":"https://github.com/advisories/GHSA-pfq2-hh62-7m96","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96","https://github.com/renovatebot/renovate/releases/tag/42.68.5"],"description":"Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["42.68.5"],"state":"fixed","available":[{"version":"42.68.5","date":"2026-01-14","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"renovate","version":"37.374.1"}},"found":{"vulnerabilityID":"GHSA-pfq2-hh62-7m96","versionConstraint":">=32.124.0,<42.68.5 (semantic)"},"fix":{"suggestedVersion":"42.68.5"}}],"artifact":{"id":"pkg:npm/renovate@37.374.1?package-id=7601ded5d9878714","name":"renovate","version":"37.374.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["AGPL-3.0-only"],"cpes":["cpe:2.3:a:renovate:renovate:37.374.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/renovate@37.374.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6475-r3vj-m8vf","dataSource":"https://github.com/advisories/GHSA-6475-r3vj-m8vf","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/aws/aws-sdk-js-v3/security/advisories/GHSA-6475-r3vj-m8vf","https://github.com/aws/aws-sdk-js/security/advisories/GHSA-j965-2qgj-vjmq","https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/security.html"],"description":"AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.4.0"],"state":"fixed","available":[{"version":"4.4.0","date":"2026-01-10","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@smithy/config-resolver","version":"2.2.0"}},"found":{"vulnerabilityID":"GHSA-6475-r3vj-m8vf","versionConstraint":"<4.4.0 (semantic)"},"fix":{"suggestedVersion":"4.4.0"}}],"artifact":{"id":"pkg:npm/%40smithy/config-resolver@2.2.0?package-id=315dc319d8087880","name":"@smithy/config-resolver","version":"2.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@smithy\\/config-resolver:\\@smithy\\/config-resolver:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config-resolver:\\@smithy\\/config_resolver:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config_resolver:\\@smithy\\/config-resolver:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config_resolver:\\@smithy\\/config_resolver:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config:\\@smithy\\/config-resolver:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config:\\@smithy\\/config_resolver:2.2.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40smithy/config-resolver@2.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6475-r3vj-m8vf","dataSource":"https://github.com/advisories/GHSA-6475-r3vj-m8vf","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/aws/aws-sdk-js-v3/security/advisories/GHSA-6475-r3vj-m8vf","https://github.com/aws/aws-sdk-js/security/advisories/GHSA-j965-2qgj-vjmq","https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/security.html"],"description":"AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.4.0"],"state":"fixed","available":[{"version":"4.4.0","date":"2026-01-10","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@smithy/config-resolver","version":"3.0.0"}},"found":{"vulnerabilityID":"GHSA-6475-r3vj-m8vf","versionConstraint":"<4.4.0 (semantic)"},"fix":{"suggestedVersion":"4.4.0"}}],"artifact":{"id":"pkg:npm/%40smithy/config-resolver@3.0.0?package-id=6e27a156699d4e8f","name":"@smithy/config-resolver","version":"3.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@smithy\\/config-resolver:\\@smithy\\/config-resolver:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config-resolver:\\@smithy\\/config_resolver:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config_resolver:\\@smithy\\/config-resolver:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config_resolver:\\@smithy\\/config_resolver:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config:\\@smithy\\/config-resolver:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@smithy\\/config:\\@smithy\\/config_resolver:3.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40smithy/config-resolver@3.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-442j-39wm-28r2","dataSource":"https://github.com/advisories/GHSA-442j-39wm-28r2","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"],"description":"Handlebars.js has a Property Access Validation Bypass in container.lookup","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-442j-39wm-28r2","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=00e7ca619d26c72b","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GO-2026-4316","dataSource":"https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://github.com/go-chi/chi/commit/6eb35881c0e438ffb663ddbad3a61babaa5e5d8a","https://github.com/go-chi/chi/issues/1037"],"description":"Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"GHSA-mqqf-5wvp-8fh8","dataSource":"https://github.com/advisories/GHSA-mqqf-5wvp-8fh8","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8","https://github.com/go-chi/chi/issues/1037","https://github.com/go-chi/chi/commit/6eb35881c0e438ffb663ddbad3a61babaa5e5d8a","https://nvd.nist.gov/vuln/detail/CVE-2025-69725","http://go-chichi.com"],"description":"chi has an open redirect vulnerability in the RedirectSlashes middleware","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69725","epss":0.00258,"percentile":0.17542,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69725","cwe":"CWE-601","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/go-chi/chi","version":"v4.1.2+incompatible"}},"found":{"vulnerabilityID":"GO-2026-4316","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/go-chi/chi@v4.1.2%2Bincompatible?package-id=e98fc30f2cc60aa8","name":"github.com/go-chi/chi","version":"v4.1.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-chi:chi:v4.1.2\\+incompatible:*:*:*:*:*:*:*","cpe:2.3:a:go_chi:chi:v4.1.2\\+incompatible:*:*:*:*:*:*:*","cpe:2.3:a:go:chi:v4.1.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-chi/chi@v4.1.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec="}}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.36.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.36.0?package-id=969591df21e20616","name":"golang.org/x/crypto","version":"v0.36.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.36.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.36.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.36.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34="}}}],"source":{"type":"file","target":"slsa-framework/slsa-verifier"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:08:23.517896989Z"}}