{"matches":[{"vulnerability":{"id":"GHSA-mrrh-fwg8-r2c3","dataSource":"https://github.com/advisories/GHSA-mrrh-fwg8-r2c3","namespace":"github:language:github-action","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-30066","https://github.com/tj-actions/changed-files/issues/2463","https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193","https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised","https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised","https://github.com/chains-project/maven-lockfile/pull/1111","https://github.com/rackerlabs/genestack/pull/903","https://news.ycombinator.com/item?id=43367987","https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463","https://github.com/espressif/arduino-esp32/issues/11127","https://github.com/modal-labs/modal-examples/issues/1100","https://github.com/tj-actions/changed-files/issues/2464","https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28","https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066","https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066","https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack","https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond","https://github.com/tj-actions/changed-files/issues/2477","https://github.com/tj-actions/changed-files/releases/tag/v46.0.1","https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066","https://blog.gitguardian.com/compromised-tj-actions","https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x5m5","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066","https://news.ycombinator.com/item?id=43368870"],"description":"tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2025-30066","vendorProject":"tj-actions","product":"changed-files GitHub Action","dateAdded":"2025-03-18","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-04-08","knownRansomwareCampaignUse":"unknown","notes":"This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction; Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-30066"],"cwes":["CWE-506"]}],"epss":[{"cve":"CVE-2025-30066","epss":0.72092,"percentile":0.99431,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30066","cwe":"CWE-506","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-30066","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["46.0.1"],"state":"fixed","available":[{"version":"46.0.1","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":84.52499999999999},"relatedVulnerabilities":[{"id":"CVE-2025-30066","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-30066","namespace":"nvd:cpe","severity":"High","urls":["https://blog.gitguardian.com/compromised-tj-actions/","https://github.com/chains-project/maven-lockfile/pull/1111","https://github.com/espressif/arduino-esp32/issues/11127","https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193","https://github.com/modal-labs/modal-examples/issues/1100","https://github.com/rackerlabs/genestack/pull/903","https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28","https://github.com/tj-actions/changed-files/issues/2463","https://github.com/tj-actions/changed-files/issues/2464","https://github.com/tj-actions/changed-files/issues/2477","https://news.ycombinator.com/item?id=43367987","https://news.ycombinator.com/item?id=43368870","https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/","https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/","https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463","https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised","https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond","https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack","https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066","https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066"],"description":"tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2025-30066","vendorProject":"tj-actions","product":"changed-files GitHub Action","dateAdded":"2025-03-18","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-04-08","knownRansomwareCampaignUse":"unknown","notes":"This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction; Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-30066"],"cwes":["CWE-506"]}],"epss":[{"cve":"CVE-2025-30066","epss":0.72092,"percentile":0.99431,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-30066","cwe":"CWE-506","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-30066","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"tj-actions/changed-files","version":"v44.5.2"}},"found":{"vulnerabilityID":"GHSA-mrrh-fwg8-r2c3","versionConstraint":"<=45.0.7 (unknown)"},"fix":{"suggestedVersion":"46.0.1"}}],"artifact":{"id":"pkg:github/tj-actions/changed-files@v44.5.2?package-id=caf8c52150a5e68f","name":"tj-actions/changed-files","version":"v44.5.2","type":"github-action","locations":[{"path":"/.github/workflows/iac-smoke-tests-pulls.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:tj-actions\\/changed-files:tj-actions\\/changed-files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/changed-files:tj_actions\\/changed_files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/changed_files:tj-actions\\/changed-files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/changed_files:tj_actions\\/changed_files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/changed:tj-actions\\/changed-files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj-actions\\/changed:tj_actions\\/changed_files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/changed:tj-actions\\/changed-files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj_actions\\/changed:tj_actions\\/changed_files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj:tj-actions\\/changed-files:v44.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tj:tj_actions\\/changed_files:v44.5.2:*:*:*:*:*:*:*"],"purl":"pkg:github/tj-actions/changed-files@v44.5.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w573-4hg7-7wgq","dataSource":"https://github.com/advisories/GHSA-w573-4hg7-7wgq","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-38900","https://github.com/SamVerschueren/decode-uri-component/issues/5","https://github.com/sindresorhus/query-string/issues/345","https://github.com/SamVerschueren/decode-uri-component/commit/746ca5dcb6667c5d364e782d53c542830e4c10b9","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.2.1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/"],"description":"decode-uri-component vulnerable to Denial of Service (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-38900","epss":0.2361,"percentile":0.97808,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.2.1"],"state":"fixed","available":[{"version":"0.2.1","date":"2022-12-02","kind":"first-observed"}]},"advisories":[],"risk":17.7075},"relatedVulnerabilities":[{"id":"CVE-2022-38900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/issues/5","https://github.com/sindresorhus/query-string/issues/345","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-38900","epss":0.2361,"percentile":0.97808,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-w573-4hg7-7wgq","versionConstraint":"<0.2.1 (semantic)"},"fix":{"suggestedVersion":"0.2.1"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=76f950c9d6d1be13","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrpp-h998-j3pp","dataSource":"https://github.com/advisories/GHSA-hrpp-h998-j3pp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24999","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec","https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68","https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b","https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d","https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1","https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105","https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f","https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee","https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda","https://github.com/expressjs/express/releases/tag/4.17.3","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005"],"description":"qs vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24999","epss":0.15622,"percentile":0.96843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.7.3"],"state":"fixed","available":[{"version":"6.7.3","date":"2022-12-07","kind":"first-observed"}]},"advisories":[],"risk":11.7165},"relatedVulnerabilities":[{"id":"CVE-2022-24999","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/express/releases/tag/4.17.3","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005/"],"description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24999","epss":0.15622,"percentile":0.96843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-hrpp-h998-j3pp","versionConstraint":">=6.7.0,<6.7.3 (semantic)"},"fix":{"suggestedVersion":"6.7.3"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=c5032cc2b96d1098","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c47-m6qq-7p4h","dataSource":"https://github.com/advisories/GHSA-9c47-m6qq-7p4h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://nvd.nist.gov/vuln/detail/CVE-2022-46175","https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/commit/62a65408408d40aeea14c7869ed327acead12972","https://github.com/json5/json5/commit/7774c1097993bc3ce9f0ac4b722a32bf7d6871c8","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE"],"description":"Prototype Pollution in JSON5 via Parse Method","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.0.2"],"state":"fixed","available":[{"version":"1.0.2","date":"2023-01-04","kind":"first-observed"}]},"advisories":[],"risk":7.07954},"relatedVulnerabilities":[{"id":"CVE-2022-46175","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-46175","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/"],"description":"JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"json5","version":"1.0.1"}},"found":{"vulnerabilityID":"GHSA-9c47-m6qq-7p4h","versionConstraint":"<1.0.2 (semantic)"},"fix":{"suggestedVersion":"1.0.2"}}],"artifact":{"id":"pkg:npm/json5@1.0.1?package-id=42d27461ecef8d14","name":"json5","version":"1.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:json5:json5:1.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/json5@1.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-g4rg-993r-mgx7","dataSource":"https://github.com/advisories/GHSA-g4rg-993r-mgx7","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-42740","https://www.npmjs.com/package/shell-quote","https://github.com/ljharb/shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe","https://github.com/ljharb/shell-quote/blob/master/CHANGELOG.md#173"],"description":"Improper Neutralization of Special Elements used in a Command in Shell-quote","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-42740","epss":0.04221,"percentile":0.90999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-42740","cwe":"CWE-77","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.7.3"],"state":"fixed","available":[{"version":"1.7.3","date":"2022-06-22","kind":"first-observed"}]},"advisories":[],"risk":3.96774},"relatedVulnerabilities":[{"id":"CVE-2021-42740","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42740","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173","https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe","https://www.npmjs.com/package/shell-quote"],"description":"The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-42740","epss":0.04221,"percentile":0.90999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-42740","cwe":"CWE-77","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"shell-quote","version":"1.7.2"}},"found":{"vulnerabilityID":"GHSA-g4rg-993r-mgx7","versionConstraint":">=1.6.3,<=1.7.2 (semantic)"},"fix":{"suggestedVersion":"1.7.3"}}],"artifact":{"id":"pkg:npm/shell-quote@1.7.2?package-id=c41ad5d968719cf3","name":"shell-quote","version":"1.7.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:shell-quote_project:shell-quote:1.7.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/shell-quote@1.7.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-p6mc-m468-83gw","dataSource":"https://github.com/advisories/GHSA-p6mc-m468-83gw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/issues/4744","https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12","https://nvd.nist.gov/vuln/detail/CVE-2020-8203","https://hackerone.com/reports/712065","https://github.com/lodash/lodash/issues/4874","https://github.com/github/advisory-database/pull/2884","https://hackerone.com/reports/864701","https://github.com/lodash/lodash/wiki/Changelog#v41719","https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744","https://security.netapp.com/advisory/ntap-20200724-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":3.883685},"relatedVulnerabilities":[{"id":"CVE-2020-8203","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash.pick","version":"4.4.0"}},"found":{"vulnerabilityID":"GHSA-p6mc-m468-83gw","versionConstraint":">=4.0.0,<=4.4.0 (semantic)"}}],"artifact":{"id":"pkg:npm/lodash.pick@4.4.0?package-id=f041d1bf788b8548","name":"lodash.pick","version":"4.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash.pick:lodash.pick:4.4.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/lodash.pick@4.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p6mc-m468-83gw","dataSource":"https://github.com/advisories/GHSA-p6mc-m468-83gw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/issues/4744","https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12","https://nvd.nist.gov/vuln/detail/CVE-2020-8203","https://hackerone.com/reports/712065","https://github.com/lodash/lodash/issues/4874","https://github.com/github/advisory-database/pull/2884","https://hackerone.com/reports/864701","https://github.com/lodash/lodash/wiki/Changelog#v41719","https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744","https://security.netapp.com/advisory/ntap-20200724-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":3.883685},"relatedVulnerabilities":[{"id":"CVE-2020-8203","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash.set","version":"4.3.2"}},"found":{"vulnerabilityID":"GHSA-p6mc-m468-83gw","versionConstraint":">=3.7.0,<=4.3.2 (semantic)"}}],"artifact":{"id":"pkg:npm/lodash.set@4.3.2?package-id=8ef36f5c77ee70fe","name":"lodash.set","version":"4.3.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash.set:lodash.set:4.3.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/lodash.set@4.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-76p3-8jx3-jpfq","dataSource":"https://github.com/advisories/GHSA-76p3-8jx3-jpfq","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-37601","https://github.com/webpack/loader-utils/issues/212","https://github.com/webpack/loader-utils/releases/tag/v2.0.3","https://github.com/webpack/loader-utils/pull/217","https://github.com/webpack/loader-utils/pull/220","https://github.com/webpack/loader-utils/releases/tag/v1.4.1","https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884","https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826","https://dl.acm.org/doi/abs/10.1145/3488932.3497769","https://dl.acm.org/doi/pdf/10.1145/3488932.3497769","https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html","http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf","https://github.com/webpack/loader-utils/commit/f4e48a232fae900237c3e5ff7b57ce9e1c734de1","https://github.com/webpack/loader-utils/commit/4504e34c4796a5836ef70458327351675aed48a5","https://github.com/webpack/loader-utils/commit/a93cf6f4702012030f6b5ee8340d5c95ec1c7d4c"],"description":"Prototype pollution in webpack loader-utils","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37601","epss":0.03503,"percentile":0.89174,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37601","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2022-11-08","kind":"first-observed"}]},"advisories":[],"risk":3.29282},"relatedVulnerabilities":[{"id":"CVE-2022-37601","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37601","namespace":"nvd:cpe","severity":"Critical","urls":["http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf","https://dl.acm.org/doi/abs/10.1145/3488932.3497769","https://dl.acm.org/doi/pdf/10.1145/3488932.3497769","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47","https://github.com/webpack/loader-utils/issues/212","https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884","https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826","https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html"],"description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37601","epss":0.03503,"percentile":0.89174,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37601","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"loader-utils","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-76p3-8jx3-jpfq","versionConstraint":"<1.4.1 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/loader-utils@1.4.0?package-id=f75fd64943a8c9c9","name":"loader-utils","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:loader-utils:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader-utils:loader_utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader_utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader_utils:1.4.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/loader-utils@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-76p3-8jx3-jpfq","dataSource":"https://github.com/advisories/GHSA-76p3-8jx3-jpfq","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-37601","https://github.com/webpack/loader-utils/issues/212","https://github.com/webpack/loader-utils/releases/tag/v2.0.3","https://github.com/webpack/loader-utils/pull/217","https://github.com/webpack/loader-utils/pull/220","https://github.com/webpack/loader-utils/releases/tag/v1.4.1","https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884","https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826","https://dl.acm.org/doi/abs/10.1145/3488932.3497769","https://dl.acm.org/doi/pdf/10.1145/3488932.3497769","https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html","http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf","https://github.com/webpack/loader-utils/commit/f4e48a232fae900237c3e5ff7b57ce9e1c734de1","https://github.com/webpack/loader-utils/commit/4504e34c4796a5836ef70458327351675aed48a5","https://github.com/webpack/loader-utils/commit/a93cf6f4702012030f6b5ee8340d5c95ec1c7d4c"],"description":"Prototype pollution in webpack loader-utils","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37601","epss":0.03503,"percentile":0.89174,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37601","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.0.3"],"state":"fixed","available":[{"version":"2.0.3","date":"2022-11-06","kind":"first-observed"}]},"advisories":[],"risk":3.29282},"relatedVulnerabilities":[{"id":"CVE-2022-37601","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37601","namespace":"nvd:cpe","severity":"Critical","urls":["http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf","https://dl.acm.org/doi/abs/10.1145/3488932.3497769","https://dl.acm.org/doi/pdf/10.1145/3488932.3497769","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47","https://github.com/webpack/loader-utils/issues/212","https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884","https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826","https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html"],"description":"Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37601","epss":0.03503,"percentile":0.89174,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37601","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"loader-utils","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-76p3-8jx3-jpfq","versionConstraint":">=2.0.0,<2.0.3 (semantic)"},"fix":{"suggestedVersion":"2.0.3"}}],"artifact":{"id":"pkg:npm/loader-utils@2.0.1?package-id=008847c431922914","name":"loader-utils","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:loader-utils:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader-utils:loader_utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader_utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader_utils:2.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/loader-utils@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4wf5-vphf-c2xc","dataSource":"https://github.com/advisories/GHSA-4wf5-vphf-c2xc","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25858","https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b","https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012","https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722","https://snyk.io/vuln/SNYK-JS-TERSER-2806366"],"description":"Terser insecure use of regular expressions leads to ReDoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25858","epss":0.03253,"percentile":0.88347,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25858","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["5.14.2"],"state":"fixed","available":[{"version":"5.14.2","date":"2022-07-21","kind":"first-observed"}]},"advisories":[],"risk":2.43975},"relatedVulnerabilities":[{"id":"CVE-2022-25858","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25858","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135","https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b","https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722","https://snyk.io/vuln/SNYK-JS-TERSER-2806366"],"description":"The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25858","epss":0.03253,"percentile":0.88347,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25858","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"terser","version":"5.7.1"}},"found":{"vulnerabilityID":"GHSA-4wf5-vphf-c2xc","versionConstraint":">=5.0.0,<5.14.2 (semantic)"},"fix":{"suggestedVersion":"5.14.2"}}],"artifact":{"id":"pkg:npm/terser@5.7.1?package-id=01ae60e46b0dbe54","name":"terser","version":"5.7.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-2-Clause"],"cpes":["cpe:2.3:a:terser:terser:5.7.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/terser@5.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5j98-mcp5-4vw2","dataSource":"https://github.com/advisories/GHSA-5j98-mcp5-4vw2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://nvd.nist.gov/vuln/detail/CVE-2025-64756","https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f"],"description":"glob CLI: Command injection via -c/--cmd executes matches with shell:true","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.0309,"percentile":0.87716,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.0"],"state":"fixed","available":[{"version":"10.5.0","date":"2025-11-19","kind":"first-observed"}]},"advisories":[],"risk":2.3175},"relatedVulnerabilities":[{"id":"CVE-2025-64756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2"],"description":"Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.0309,"percentile":0.87716,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.4.1"}},"found":{"vulnerabilityID":"GHSA-5j98-mcp5-4vw2","versionConstraint":">=10.2.0,<10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.0"}}],"artifact":{"id":"pkg:npm/glob@10.4.1?package-id=d7d402979916b388","name":"glob","version":"10.4.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.4.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.4.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-hhq3-ff78-jv3g","dataSource":"https://github.com/advisories/GHSA-hhq3-ff78-jv3g","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-37599","https://github.com/webpack/loader-utils/issues/211","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83","https://github.com/webpack/loader-utils/issues/216","https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa","https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb","https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ"],"description":"loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37599","epss":0.02761,"percentile":0.86274,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37599","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.4.2"],"state":"fixed","available":[{"version":"1.4.2","date":"2022-11-16","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-37599","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37599","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83","https://github.com/webpack/loader-utils/issues/211","https://github.com/webpack/loader-utils/issues/216","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/"],"description":"A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37599","epss":0.02761,"percentile":0.86274,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37599","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"loader-utils","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-hhq3-ff78-jv3g","versionConstraint":">=1.0.0,<1.4.2 (semantic)"},"fix":{"suggestedVersion":"1.4.2"}}],"artifact":{"id":"pkg:npm/loader-utils@1.4.0?package-id=f75fd64943a8c9c9","name":"loader-utils","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:loader-utils:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader-utils:loader_utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader_utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader_utils:1.4.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/loader-utils@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hhq3-ff78-jv3g","dataSource":"https://github.com/advisories/GHSA-hhq3-ff78-jv3g","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-37599","https://github.com/webpack/loader-utils/issues/211","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83","https://github.com/webpack/loader-utils/issues/216","https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa","https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb","https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ"],"description":"loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37599","epss":0.02761,"percentile":0.86274,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37599","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.0.4"],"state":"fixed","available":[{"version":"2.0.4","date":"2022-11-16","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-37599","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37599","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83","https://github.com/webpack/loader-utils/issues/211","https://github.com/webpack/loader-utils/issues/216","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/"],"description":"A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37599","epss":0.02761,"percentile":0.86274,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37599","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"loader-utils","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-hhq3-ff78-jv3g","versionConstraint":">=2.0.0,<2.0.4 (semantic)"},"fix":{"suggestedVersion":"2.0.4"}}],"artifact":{"id":"pkg:npm/loader-utils@2.0.1?package-id=008847c431922914","name":"loader-utils","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:loader-utils:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader-utils:loader_utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader_utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader_utils:2.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/loader-utils@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.3.1"],"state":"fixed","available":[{"version":"6.3.1","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"6.3.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=6.0.0,<6.3.1 (semantic)"},"fix":{"suggestedVersion":"6.3.1"}}],"artifact":{"id":"pkg:npm/semver@6.3.0?package-id=e129a927f7963500","name":"semver","version":"6.3.0","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:6.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@6.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.5.2"],"state":"fixed","available":[{"version":"7.5.2","date":"2023-06-23","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"7.3.8"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=7.0.0,<7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.2"}}],"artifact":{"id":"pkg:npm/semver@7.3.8?package-id=1bcd76d03f85534d","name":"semver","version":"7.3.8","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:7.3.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@7.3.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-3rfm-jhwj-7488","dataSource":"https://github.com/advisories/GHSA-3rfm-jhwj-7488","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-37603","https://github.com/webpack/loader-utils/issues/213","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/issues/216","https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa","https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb","https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37603","epss":0.02702,"percentile":0.8594,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["1.4.2"],"state":"fixed","available":[{"version":"1.4.2","date":"2022-11-16","kind":"first-observed"}]},"advisories":[],"risk":2.0265},"relatedVulnerabilities":[{"id":"CVE-2022-37603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37603","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/issues/213","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37603","epss":0.02702,"percentile":0.8594,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"loader-utils","version":"1.4.0"}},"found":{"vulnerabilityID":"GHSA-3rfm-jhwj-7488","versionConstraint":">=1.0.0,<1.4.2 (semantic)"},"fix":{"suggestedVersion":"1.4.2"}}],"artifact":{"id":"pkg:npm/loader-utils@1.4.0?package-id=f75fd64943a8c9c9","name":"loader-utils","version":"1.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:loader-utils:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader-utils:loader_utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader_utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader-utils:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader_utils:1.4.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/loader-utils@1.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3rfm-jhwj-7488","dataSource":"https://github.com/advisories/GHSA-3rfm-jhwj-7488","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-37603","https://github.com/webpack/loader-utils/issues/213","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/issues/216","https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa","https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb","https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37603","epss":0.02702,"percentile":0.8594,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["2.0.4"],"state":"fixed","available":[{"version":"2.0.4","date":"2022-11-16","kind":"first-observed"}]},"advisories":[],"risk":2.0265},"relatedVulnerabilities":[{"id":"CVE-2022-37603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37603","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107","https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38","https://github.com/webpack/loader-utils/issues/213","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-37603","epss":0.02702,"percentile":0.8594,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-37603","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"loader-utils","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-3rfm-jhwj-7488","versionConstraint":">=2.0.0,<2.0.4 (semantic)"},"fix":{"suggestedVersion":"2.0.4"}}],"artifact":{"id":"pkg:npm/loader-utils@2.0.1?package-id=008847c431922914","name":"loader-utils","version":"2.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:loader-utils:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader-utils:loader_utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader_utils:loader_utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader-utils:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:loader:loader_utils:2.0.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/loader-utils@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2w6w-674q-4c4q","dataSource":"https://github.com/advisories/GHSA-2w6w-674q-4c4q","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33937"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33937","epss":0.01907,"percentile":0.79759,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":1.7925800000000003},"relatedVulnerabilities":[{"id":"CVE-2026-33937","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33937","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33937","https://bugzilla.redhat.com/show_bug.cgi?id=2452523","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33937.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling `Handlebars.compile()`; ensure the argument is always a  `string`, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time; `compile()` will be unavailable.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33937","epss":0.01907,"percentile":0.79759,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-2w6w-674q-4c4q","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x6g-3cmx-w76r","dataSource":"https://github.com/advisories/GHSA-4x6g-3cmx-w76r","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22984","https://github.com/snyk/cli/commit/80d97a93326406e09776156daf72e3caa03ae25a","https://github.com/snyk/snyk-cocoapods-plugin/commit/c73e049c5200772babde61c40aab57296bf91381","https://github.com/snyk/snyk-docker-plugin/commit/d730d7630691a61587b120bb11daaaf4b58a8357","https://github.com/snyk/snyk-gradle-plugin/commit/bb1c1c72a75e97723a76b14d2d73f70744ed5009","https://github.com/snyk/snyk-hex-plugin/commit/e8dd2a330b40d7fc0ab47e34413e80a0146d7ac3","https://github.com/snyk/snyk-mvn-plugin/commit/02cda9ba1ea36b00ead3f6ec2de0f97397ebec50","https://github.com/snyk/snyk-python-plugin/commit/8591abdd9236108ac3e30c70c09238d6bb6aabf4","https://github.com/snyk/snyk-sbt-plugin/commit/99c09eb12c9f8f2b237aea9627aab1ae3cab6437","https://security.snyk.io/vuln/SNYK-JS-SNYK-3038622","https://security.snyk.io/vuln/SNYK-JS-SNYKDOCKERPLUGIN-3039679","https://security.snyk.io/vuln/SNYK-JS-SNYKGRADLEPLUGIN-3038624","https://security.snyk.io/vuln/SNYK-JS-SNYKMVNPLUGIN-3038623","https://security.snyk.io/vuln/SNYK-JS-SNYKPYTHONPLUGIN-3039677","https://security.snyk.io/vuln/SNYK-JS-SNYKSBTPLUGIN-3038626","https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKCOCOAPODSPLUGIN-3038625","https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKHEXPLUGIN-3039680","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"Snyk plugins vulnerable to Command Injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22984","epss":0.03115,"percentile":0.87813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-22984","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-22984","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["1.1064.0"],"state":"fixed","available":[{"version":"1.1064.0","date":"2022-12-16","kind":"first-observed"}]},"advisories":[],"risk":1.7599749999999998},"relatedVulnerabilities":[{"id":"CVE-2022-22984","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22984","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/snyk/cli/commit/80d97a93326406e09776156daf72e3caa03ae25a","https://github.com/snyk/snyk-cocoapods-plugin/commit/c73e049c5200772babde61c40aab57296bf91381","https://github.com/snyk/snyk-docker-plugin/commit/d730d7630691a61587b120bb11daaaf4b58a8357","https://github.com/snyk/snyk-gradle-plugin/commit/bb1c1c72a75e97723a76b14d2d73f70744ed5009","https://github.com/snyk/snyk-hex-plugin/commit/e8dd2a330b40d7fc0ab47e34413e80a0146d7ac3","https://github.com/snyk/snyk-mvn-plugin/commit/02cda9ba1ea36b00ead3f6ec2de0f97397ebec50","https://github.com/snyk/snyk-python-plugin/commit/8591abdd9236108ac3e30c70c09238d6bb6aabf4","https://github.com/snyk/snyk-sbt-plugin/commit/99c09eb12c9f8f2b237aea9627aab1ae3cab6437","https://security.snyk.io/vuln/SNYK-JS-SNYK-3038622","https://security.snyk.io/vuln/SNYK-JS-SNYKDOCKERPLUGIN-3039679","https://security.snyk.io/vuln/SNYK-JS-SNYKGRADLEPLUGIN-3038624","https://security.snyk.io/vuln/SNYK-JS-SNYKMVNPLUGIN-3038623","https://security.snyk.io/vuln/SNYK-JS-SNYKPYTHONPLUGIN-3039677","https://security.snyk.io/vuln/SNYK-JS-SNYKSBTPLUGIN-3038626","https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKCOCOAPODSPLUGIN-3038625","https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKHEXPLUGIN-3039680","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin before 5.6.5; the package @snyk/snyk-hex-plugin before 1.1.6 are vulnerable to Command Injection due to an incomplete fix for [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342). A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the snyk test command on untrusted files. In most cases, an attacker positioned to control the command line arguments to the Snyk CLI would already be positioned to execute arbitrary commands. However, this could be abused in specific scenarios, such as continuous integration pipelines, where developers can control the arguments passed to the Snyk CLI to leverage this component as part of a wider attack against an integration/build pipeline. This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22984","epss":0.03115,"percentile":0.87813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-22984","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-22984","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"snyk","version":"1.0.0-monorepo"}},"found":{"vulnerabilityID":"GHSA-4x6g-3cmx-w76r","versionConstraint":"<1.1064.0 (semantic)"},"fix":{"suggestedVersion":"1.1064.0"}}],"artifact":{"id":"pkg:npm/snyk@1.0.0-monorepo?package-id=e49646e4373d0b2b","name":"snyk","version":"1.0.0-monorepo","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:snyk:snyk:1.0.0-monorepo:*:*:*:*:*:*:*"],"purl":"pkg:npm/snyk@1.0.0-monorepo","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x6g-3cmx-w76r","dataSource":"https://github.com/advisories/GHSA-4x6g-3cmx-w76r","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22984","https://github.com/snyk/cli/commit/80d97a93326406e09776156daf72e3caa03ae25a","https://github.com/snyk/snyk-cocoapods-plugin/commit/c73e049c5200772babde61c40aab57296bf91381","https://github.com/snyk/snyk-docker-plugin/commit/d730d7630691a61587b120bb11daaaf4b58a8357","https://github.com/snyk/snyk-gradle-plugin/commit/bb1c1c72a75e97723a76b14d2d73f70744ed5009","https://github.com/snyk/snyk-hex-plugin/commit/e8dd2a330b40d7fc0ab47e34413e80a0146d7ac3","https://github.com/snyk/snyk-mvn-plugin/commit/02cda9ba1ea36b00ead3f6ec2de0f97397ebec50","https://github.com/snyk/snyk-python-plugin/commit/8591abdd9236108ac3e30c70c09238d6bb6aabf4","https://github.com/snyk/snyk-sbt-plugin/commit/99c09eb12c9f8f2b237aea9627aab1ae3cab6437","https://security.snyk.io/vuln/SNYK-JS-SNYK-3038622","https://security.snyk.io/vuln/SNYK-JS-SNYKDOCKERPLUGIN-3039679","https://security.snyk.io/vuln/SNYK-JS-SNYKGRADLEPLUGIN-3038624","https://security.snyk.io/vuln/SNYK-JS-SNYKMVNPLUGIN-3038623","https://security.snyk.io/vuln/SNYK-JS-SNYKPYTHONPLUGIN-3039677","https://security.snyk.io/vuln/SNYK-JS-SNYKSBTPLUGIN-3038626","https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKCOCOAPODSPLUGIN-3038625","https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKHEXPLUGIN-3039680","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"Snyk plugins vulnerable to Command Injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22984","epss":0.03115,"percentile":0.87813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-22984","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-22984","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["1.1064.0"],"state":"fixed","available":[{"version":"1.1064.0","date":"2022-12-16","kind":"first-observed"}]},"advisories":[],"risk":1.7599749999999998},"relatedVulnerabilities":[{"id":"CVE-2022-22984","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22984","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/snyk/cli/commit/80d97a93326406e09776156daf72e3caa03ae25a","https://github.com/snyk/snyk-cocoapods-plugin/commit/c73e049c5200772babde61c40aab57296bf91381","https://github.com/snyk/snyk-docker-plugin/commit/d730d7630691a61587b120bb11daaaf4b58a8357","https://github.com/snyk/snyk-gradle-plugin/commit/bb1c1c72a75e97723a76b14d2d73f70744ed5009","https://github.com/snyk/snyk-hex-plugin/commit/e8dd2a330b40d7fc0ab47e34413e80a0146d7ac3","https://github.com/snyk/snyk-mvn-plugin/commit/02cda9ba1ea36b00ead3f6ec2de0f97397ebec50","https://github.com/snyk/snyk-python-plugin/commit/8591abdd9236108ac3e30c70c09238d6bb6aabf4","https://github.com/snyk/snyk-sbt-plugin/commit/99c09eb12c9f8f2b237aea9627aab1ae3cab6437","https://security.snyk.io/vuln/SNYK-JS-SNYK-3038622","https://security.snyk.io/vuln/SNYK-JS-SNYKDOCKERPLUGIN-3039679","https://security.snyk.io/vuln/SNYK-JS-SNYKGRADLEPLUGIN-3038624","https://security.snyk.io/vuln/SNYK-JS-SNYKMVNPLUGIN-3038623","https://security.snyk.io/vuln/SNYK-JS-SNYKPYTHONPLUGIN-3039677","https://security.snyk.io/vuln/SNYK-JS-SNYKSBTPLUGIN-3038626","https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKCOCOAPODSPLUGIN-3038625","https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKHEXPLUGIN-3039680","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin before 5.6.5; the package @snyk/snyk-hex-plugin before 1.1.6 are vulnerable to Command Injection due to an incomplete fix for [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342). A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the snyk test command on untrusted files. In most cases, an attacker positioned to control the command line arguments to the Snyk CLI would already be positioned to execute arbitrary commands. However, this could be abused in specific scenarios, such as continuous integration pipelines, where developers can control the arguments passed to the Snyk CLI to leverage this component as part of a wider attack against an integration/build pipeline. This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22984","epss":0.03115,"percentile":0.87813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-22984","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-22984","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"snyk","version":"1.0.0-monorepo"}},"found":{"vulnerabilityID":"GHSA-4x6g-3cmx-w76r","versionConstraint":"<1.1064.0 (semantic)"},"fix":{"suggestedVersion":"1.1064.0"}}],"artifact":{"id":"pkg:npm/snyk@1.0.0-monorepo?package-id=846527b067d5b74a","name":"snyk","version":"1.0.0-monorepo","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:snyk:snyk:1.0.0-monorepo:*:*:*:*:*:*:*"],"purl":"pkg:npm/snyk@1.0.0-monorepo","upstreams":[]}},{"vulnerability":{"id":"GHSA-pq67-2wwv-3xjx","dataSource":"https://github.com/advisories/GHSA-pq67-2wwv-3xjx","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-12905","https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed","https://arxiv.org/abs/2506.04962","https://arxiv.org/pdf/2506.04962","https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html","https://www.seal.security/blog/a-link-to-the-past-uncovering-a-new-vulnerability-in-tar-fs"],"description":"tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-12905","epss":0.02299,"percentile":0.83295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-12905","cwe":"CWE-22","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2024-12905","cwe":"CWE-59","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.1.2"],"state":"fixed","available":[{"version":"2.1.2","date":"2025-03-29","kind":"first-observed"}]},"advisories":[],"risk":1.72425},"relatedVulnerabilities":[{"id":"CVE-2024-12905","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12905","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed","https://www.seal.security/blog/a-link-to-the-past-uncovering-a-new-vulnerability-in-tar-fs","https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html"],"description":"An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-12905","epss":0.02299,"percentile":0.83295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-12905","cwe":"CWE-22","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2024-12905","cwe":"CWE-59","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar-fs","version":"2.1.1"}},"found":{"vulnerabilityID":"GHSA-pq67-2wwv-3xjx","versionConstraint":">=2.0.0,<2.1.2 (semantic)"},"fix":{"suggestedVersion":"2.1.2"}}],"artifact":{"id":"pkg:npm/tar-fs@2.1.1?package-id=2dc9b2bde2da6ab0","name":"tar-fs","version":"2.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:tar-fs:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar_fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar_fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar_fs:2.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/tar-fs@2.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-fjxv-7rqg-78g4","dataSource":"https://github.com/advisories/GHSA-fjxv-7rqg-78g4","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://nvd.nist.gov/vuln/detail/CVE-2025-7783","https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/benweissmann/CVE-2025-7783-poc","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"],"description":"form-data uses unsafe random function in form-data for choosing boundary","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7783","epss":0.0181,"percentile":0.78614,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7783","cwe":"CWE-330","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["2.5.4"],"state":"fixed","available":[{"version":"2.5.4","date":"2025-07-22","kind":"first-observed"}]},"advisories":[],"risk":1.6652000000000005},"relatedVulnerabilities":[{"id":"CVE-2025-7783","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7783","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"],"description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7783","epss":0.0181,"percentile":0.78614,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7783","cwe":"CWE-330","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"2.5.1"}},"found":{"vulnerabilityID":"GHSA-fjxv-7rqg-78g4","versionConstraint":"<2.5.4 (semantic)"},"fix":{"suggestedVersion":"2.5.4"}}],"artifact":{"id":"pkg:npm/form-data@2.5.1?package-id=010767d5ac04716e","name":"form-data","version":"2.5.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:form-data:form-data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:2.5.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@2.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-hc6q-2mpp-qw7j","dataSource":"https://github.com/advisories/GHSA-hc6q-2mpp-qw7j","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-28154","https://github.com/webpack/webpack/pull/16500","https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D/"],"description":"Cross-realm object access in Webpack 5","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-28154","epss":0.01409,"percentile":0.72639,"date":"2026-10-31"}],"fix":{"versions":["5.76.0"],"state":"fixed","available":[{"version":"5.76.0","date":"2023-03-14","kind":"first-observed"}]},"advisories":[],"risk":1.32446},"relatedVulnerabilities":[{"id":"CVE-2023-28154","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-28154","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0","https://github.com/webpack/webpack/pull/16500","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D/"],"description":"Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-28154","epss":0.01409,"percentile":0.72639,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack","version":"5.54.0"}},"found":{"vulnerabilityID":"GHSA-hc6q-2mpp-qw7j","versionConstraint":">=5.0.0,<5.76.0 (semantic)"},"fix":{"suggestedVersion":"5.76.0"}}],"artifact":{"id":"pkg:npm/webpack@5.54.0?package-id=a0c270983ec54e9c","name":"webpack","version":"5.54.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack.js:webpack:5.54.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/webpack@5.54.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-grv7-fg5c-xmjg","dataSource":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4068","https://github.com/micromatch/braces/issues/35","https://devhub.checkmarx.com/cve-details/CVE-2024-4068","https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff"],"description":"Uncontrolled resource consumption in braces","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.01471,"percentile":0.73774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.0.3"],"state":"fixed","available":[{"version":"3.0.3","date":"2024-06-11","kind":"first-observed"}]},"advisories":[],"risk":1.10325},"relatedVulnerabilities":[{"id":"CVE-2024-4068","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","namespace":"nvd:cpe","severity":"High","urls":["https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","https://github.com/micromatch/braces/issues/35","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40"],"description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.01471,"percentile":0.73774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"braces","version":"3.0.2"}},"found":{"vulnerabilityID":"GHSA-grv7-fg5c-xmjg","versionConstraint":"<3.0.3 (semantic)"},"fix":{"suggestedVersion":"3.0.3"}}],"artifact":{"id":"pkg:npm/braces@3.0.2?package-id=fba8e00635c8f774","name":"braces","version":"3.0.2","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:braces_project:braces:3.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:jonschlinkert:braces:3.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/braces@3.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-96hv-2xvq-fx4p","dataSource":"https://github.com/advisories/GHSA-96hv-2xvq-fx4p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://nvd.nist.gov/vuln/detail/CVE-2026-48779","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://access.redhat.com/security/cve/CVE-2026-48779","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:26638"],"description":"ws: Memory exhaustion DoS from tiny fragments and data chunks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.21.0"],"state":"fixed","available":[{"version":"8.21.0","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":1.0695},"relatedVulnerabilities":[{"id":"CVE-2026-48779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-48779","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"],"description":"ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.17.0"}},"found":{"vulnerabilityID":"GHSA-96hv-2xvq-fx4p","versionConstraint":">=8.0.0,<8.21.0 (semantic)"},"fix":{"suggestedVersion":"8.21.0"}}],"artifact":{"id":"pkg:npm/ws@8.17.0?package-id=f7ba73e96444723e","name":"ws","version":"8.17.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:8.17.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.17.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3h5v-q93c-6h6q","dataSource":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63"],"description":"ws affected by a DoS when handling a request with many HTTP headers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.01357,"percentile":0.71669,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-37890","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.17.1"],"state":"fixed","available":[{"version":"8.17.1","date":"2024-06-18","kind":"first-observed"}]},"advisories":[],"risk":1.0584600000000002},"relatedVulnerabilities":[{"id":"CVE-2024-37890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37890","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://nodejs.org/api/http.html#servermaxheaderscount"],"description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.01357,"percentile":0.71669,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-37890","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.17.0"}},"found":{"vulnerabilityID":"GHSA-3h5v-q93c-6h6q","versionConstraint":">=8.0.0,<8.17.1 (semantic)"},"fix":{"suggestedVersion":"8.17.1"}}],"artifact":{"id":"pkg:npm/ws@8.17.0?package-id=f7ba73e96444723e","name":"ws","version":"8.17.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:8.17.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.17.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-j8xg-fqg3-53r7","dataSource":"https://github.com/advisories/GHSA-j8xg-fqg3-53r7","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-26115","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657","https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973","https://github.com/jonschlinkert/word-wrap/blob/master/index.js#L39","https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4","https://github.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e","https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"word-wrap vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26115","epss":0.01709,"percentile":0.77329,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26115","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26115","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.4"],"state":"fixed","available":[{"version":"1.2.4","date":"2023-07-19","kind":"first-observed"}]},"advisories":[],"risk":0.8801350000000001},"relatedVulnerabilities":[{"id":"CVE-2023-26115","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26115","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39","https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657","https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973"],"description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26115","epss":0.01709,"percentile":0.77329,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26115","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26115","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"word-wrap","version":"1.2.3"}},"found":{"vulnerabilityID":"GHSA-j8xg-fqg3-53r7","versionConstraint":"<1.2.4 (semantic)"},"fix":{"suggestedVersion":"1.2.4"}}],"artifact":{"id":"pkg:npm/word-wrap@1.2.3?package-id=df03e5ee21a09795","name":"word-wrap","version":"1.2.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:word-wrap_project:word-wrap:1.2.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/word-wrap@1.2.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-8gh8-hqwg-xf34","dataSource":"https://github.com/advisories/GHSA-8gh8-hqwg-xf34","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-4279","https://github.com/Starcounter-Jack/JSON-Patch/pull/262","https://github.com/Starcounter-Jack/JSON-Patch/commit/7ad6af41eabb2d799f698740a91284d762c955c9","https://github.com/Starcounter-Jack/JSON-Patch/releases/tag/3.1.1","https://blog.effectrenan.com/pwn2win-2021-illusion-web-challenge","https://vuldb.com/?ctiid.216778","https://vuldb.com/?id.216778","https://www.huntr.dev/bounties/1-npm-fast-json-patch"],"description":"Starcounter-Jack JSON-Patch Prototype Pollution vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-4279","epss":0.01156,"percentile":0.67055,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-4279","cwe":"CWE-1321","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["3.1.1"],"state":"fixed","available":[{"version":"3.1.1","date":"2022-12-31","kind":"first-observed"}]},"advisories":[],"risk":0.85544},"relatedVulnerabilities":[{"id":"CVE-2021-4279","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4279","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Starcounter-Jack/JSON-Patch/commit/7ad6af41eabb2d799f698740a91284d762c955c9","https://github.com/Starcounter-Jack/JSON-Patch/pull/262","https://github.com/Starcounter-Jack/JSON-Patch/releases/tag/3.1.1","https://vuldb.com/?ctiid.216778","https://vuldb.com/?id.216778"],"description":"A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-4279","epss":0.01156,"percentile":0.67055,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-4279","cwe":"CWE-1321","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-json-patch","version":"3.1.0"}},"found":{"vulnerabilityID":"GHSA-8gh8-hqwg-xf34","versionConstraint":"<3.1.1 (semantic)"},"fix":{"suggestedVersion":"3.1.1"}}],"artifact":{"id":"pkg:npm/fast-json-patch@3.1.0?package-id=7f64a9d389f904f3","name":"fast-json-patch","version":"3.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fast-json-patch:fast-json-patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast-json-patch:fast_json_patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast_json_patch:fast-json-patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast_json_patch:fast_json_patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast-json:fast-json-patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast-json:fast_json_patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast_json:fast-json-patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast_json:fast_json_patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast:fast-json-patch:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:fast:fast_json_patch:3.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/fast-json-patch@3.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r5x-fm3f-whwj","dataSource":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj","https://nvd.nist.gov/vuln/detail/CVE-2026-106446","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106446","epss":0.00786,"percentile":0.56142,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106446","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.73884},"relatedVulnerabilities":[{"id":"CVE-2026-106446","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106446","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106446","epss":0.00786,"percentile":0.56142,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106446","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-8r5x-fm3f-whwj","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@4.0.5?package-id=d53a13770b51efb9","name":"micromatch","version":"4.0.5","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:4.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@4.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-9wv6-86v2-598j","dataSource":"https://github.com/advisories/GHSA-9wv6-86v2-598j","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://nvd.nist.gov/vuln/detail/CVE-2024-45296","https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485","https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef","https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894","https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0","https://security.netapp.com/advisory/ntap-20250124-0001"],"description":"path-to-regexp outputs backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.1.10"],"state":"fixed","available":[{"version":"0.1.10","date":"2024-09-10","kind":"first-observed"}]},"advisories":[],"risk":0.7036600000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45296","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45296","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://security.netapp.com/advisory/ntap-20250124-0001/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-9wv6-86v2-598j","versionConstraint":"<0.1.10 (semantic)"},"fix":{"suggestedVersion":"0.1.10"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=930ccf3090d13a40","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-9wv6-86v2-598j","dataSource":"https://github.com/advisories/GHSA-9wv6-86v2-598j","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://nvd.nist.gov/vuln/detail/CVE-2024-45296","https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485","https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef","https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894","https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0","https://security.netapp.com/advisory/ntap-20250124-0001"],"description":"path-to-regexp outputs backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.9.0"],"state":"fixed","available":[{"version":"1.9.0","date":"2024-09-12","kind":"first-observed"}]},"advisories":[],"risk":0.7036600000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45296","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45296","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://security.netapp.com/advisory/ntap-20250124-0001/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"1.8.0"}},"found":{"vulnerabilityID":"GHSA-9wv6-86v2-598j","versionConstraint":">=0.2.0,<1.9.0 (semantic)"},"fix":{"suggestedVersion":"1.9.0"}}],"artifact":{"id":"pkg:npm/path-to-regexp@1.8.0?package-id=018c1aca7e3bcc1c","name":"path-to-regexp","version":"1.8.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:1.8.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@1.8.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w7jw-789q-3m8p","dataSource":"https://github.com/advisories/GHSA-w7jw-789q-3m8p","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p","https://nvd.nist.gov/vuln/detail/CVE-2026-9277","https://github.com/ljharb/shell-quote/commit/1518179","https://github.com/ljharb/shell-quote","https://www.npmjs.com/package/shell-quote","http://www.openwall.com/lists/oss-security/2026/05/23/2"],"description":"shell-quote quote() does not escape newlines in object .op values","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9277","epss":0.00793,"percentile":0.56374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9277","cwe":"CWE-77","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-9277","cwe":"CWE-78","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-9277","cwe":"CWE-78","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.8.4"],"state":"fixed","available":[{"version":"1.8.4","date":"2026-06-09","kind":"first-observed"}]},"advisories":[],"risk":0.6998224999999999},"relatedVulnerabilities":[{"id":"CVE-2026-9277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9277","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/shell-quote","https://github.com/ljharb/shell-quote/commit/1518179","https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p","https://www.npmjs.com/package/shell-quote","http://www.openwall.com/lists/oss-security/2026/05/23/2","https://access.redhat.com/errata/RHSA-2026:26072","https://access.redhat.com/errata/RHSA-2026:26077","https://access.redhat.com/errata/RHSA-2026:26079","https://access.redhat.com/errata/RHSA-2026:26080","https://access.redhat.com/errata/RHSA-2026:26090","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:28010","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:29834","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34791","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:44237","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:50850","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/security/cve/CVE-2026-9277","https://bugzilla.redhat.com/show_bug.cgi?id=2480741","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9277.json"],"description":"shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9277","epss":0.00793,"percentile":0.56374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9277","cwe":"CWE-77","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-9277","cwe":"CWE-78","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-9277","cwe":"CWE-78","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"shell-quote","version":"1.7.2"}},"found":{"vulnerabilityID":"GHSA-w7jw-789q-3m8p","versionConstraint":">=1.1.0,<=1.8.3 (semantic)"},"fix":{"suggestedVersion":"1.8.4"}}],"artifact":{"id":"pkg:npm/shell-quote@1.7.2?package-id=c41ad5d968719cf3","name":"shell-quote","version":"1.7.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:shell-quote_project:shell-quote:1.7.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/shell-quote@1.7.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rf6f-7fwh-wjgh","dataSource":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh","https://nvd.nist.gov/vuln/detail/CVE-2026-33228","https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802","https://github.com/WebReflection/flatted/releases/tag/v3.4.2","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-33228","https://bugzilla.redhat.com/show_bug.cgi?id=2449872"],"description":"Prototype Pollution via parse() in NodeJS flatted","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33228","epss":0.00838,"percentile":0.57795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33228","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33228","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.4.2"],"state":"fixed","available":[{"version":"3.4.2","date":"2026-03-20","kind":"first-observed"}]},"advisories":[],"risk":0.6871600000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33228","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802","https://github.com/WebReflection/flatted/releases/tag/v3.4.2","https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-33228","https://bugzilla.redhat.com/show_bug.cgi?id=2449872","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33228.json"],"description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33228","epss":0.00838,"percentile":0.57795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33228","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33228","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"flatted","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-rf6f-7fwh-wjgh","versionConstraint":"<=3.4.1 (semantic)"},"fix":{"suggestedVersion":"3.4.2"}}],"artifact":{"id":"pkg:npm/flatted@2.0.2?package-id=54dc4c803a1d1cc2","name":"flatted","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:flatted:flatted:2.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/flatted@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.0.6"],"state":"fixed","available":[{"version":"6.0.6","date":"2024-11-19","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"6.0.5"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":"<6.0.6 (semantic)"},"fix":{"suggestedVersion":"6.0.6"}}],"artifact":{"id":"pkg:npm/cross-spawn@6.0.5?package-id=9cb96112a9e26638","name":"cross-spawn","version":"6.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:6.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@6.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.0.5"],"state":"fixed","available":[{"version":"7.0.5","date":"2024-11-16","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"7.0.3"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":">=7.0.0,<7.0.5 (semantic)"},"fix":{"suggestedVersion":"7.0.5"}}],"artifact":{"id":"pkg:npm/cross-spawn@7.0.3?package-id=da0c86f26a6f4fdb","name":"cross-spawn","version":"7.0.3","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:7.0.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@7.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwcr-r2fm-qrc7","dataSource":"https://github.com/advisories/GHSA-qwcr-r2fm-qrc7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7","https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce","https://nvd.nist.gov/vuln/detail/CVE-2024-45590"],"description":"body-parser vulnerable to denial of service when url encoding is enabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45590","epss":0.00824,"percentile":0.57388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45590","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.3"],"state":"fixed","available":[{"version":"1.20.3","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.6427200000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45590","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce","https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7"],"description":"body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45590","epss":0.00824,"percentile":0.57388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45590","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.19.0"}},"found":{"vulnerabilityID":"GHSA-qwcr-r2fm-qrc7","versionConstraint":"<1.20.3 (semantic)"},"fix":{"suggestedVersion":"1.20.3"}}],"artifact":{"id":"pkg:npm/body-parser@1.19.0?package-id=51081b814cb442c4","name":"body-parser","version":"1.19.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:1.19.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.19.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-25h7-pfq9-p65f","dataSource":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","https://nvd.nist.gov/vuln/detail/CVE-2026-32141","https://github.com/WebReflection/flatted/pull/88","https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606"],"description":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32141","epss":0.00839,"percentile":0.57851,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32141","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-32141","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.4.0"],"state":"fixed","available":[{"version":"3.4.0","date":"2026-03-13","kind":"first-observed"}]},"advisories":[],"risk":0.62925},"relatedVulnerabilities":[{"id":"CVE-2026-32141","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","https://github.com/WebReflection/flatted/pull/88","https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-32141","https://bugzilla.redhat.com/show_bug.cgi?id=2447083","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json"],"description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32141","epss":0.00839,"percentile":0.57851,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32141","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-32141","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"flatted","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-25h7-pfq9-p65f","versionConstraint":"<3.4.0 (semantic)"},"fix":{"suggestedVersion":"3.4.0"}}],"artifact":{"id":"pkg:npm/flatted@2.0.2?package-id=54dc4c803a1d1cc2","name":"flatted","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:flatted:flatted:2.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/flatted@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4vrv-93c7-m92j","dataSource":"https://github.com/advisories/GHSA-4vrv-93c7-m92j","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24441","https://github.com/snyk/snyk-eclipse-plugin/commit/b5a8bce25a359ced75f83a729fc6b2393fc9a495","https://github.com/snyk/snyk-intellij-plugin/commit/56682f4ba6081ce1d95cb980cbfacd3809a826f4","https://github.com/snyk/snyk-ls/commit/b3229f0142f782871aa72d1a7dcf417546d568ed","https://github.com/snyk/snyk-visual-studio-plugin/commit/0b53dbbd4a3153c3ef9aaf797af3b5caad0f731a","https://github.com/snyk/vscode-extension/commit/0db3b4240be0db6a0a5c6d02c0d4231a2c4ba708","https://security.snyk.io/vuln/SNYK-JS-SNYK-3111871","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution"],"description":"snyk Code Injection vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24441","epss":0.0076,"percentile":0.55298,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24441","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24441","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["1.1064.0"],"state":"fixed","available":[{"version":"1.1064.0","date":"2023-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.6194000000000001},"relatedVulnerabilities":[{"id":"CVE-2022-24441","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24441","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/snyk/snyk-eclipse-plugin/commit/b5a8bce25a359ced75f83a729fc6b2393fc9a495","https://github.com/snyk/snyk-intellij-plugin/commit/56682f4ba6081ce1d95cb980cbfacd3809a826f4","https://github.com/snyk/snyk-ls/commit/b3229f0142f782871aa72d1a7dcf417546d568ed","https://github.com/snyk/snyk-visual-studio-plugin/commit/0b53dbbd4a3153c3ef9aaf797af3b5caad0f731a","https://github.com/snyk/vscode-extension/commit/0db3b4240be0db6a0a5c6d02c0d4231a2c4ba708","https://security.snyk.io/vuln/SNYK-JS-SNYK-3111871","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","metrics":{"baseScore":5.8,"exploitabilityScore":1.7,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24441","epss":0.0076,"percentile":0.55298,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24441","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24441","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"snyk","version":"1.0.0-monorepo"}},"found":{"vulnerabilityID":"GHSA-4vrv-93c7-m92j","versionConstraint":"<1.1064.0 (semantic)"},"fix":{"suggestedVersion":"1.1064.0"}}],"artifact":{"id":"pkg:npm/snyk@1.0.0-monorepo?package-id=e49646e4373d0b2b","name":"snyk","version":"1.0.0-monorepo","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:snyk:snyk:1.0.0-monorepo:*:*:*:*:*:*:*"],"purl":"pkg:npm/snyk@1.0.0-monorepo","upstreams":[]}},{"vulnerability":{"id":"GHSA-4vrv-93c7-m92j","dataSource":"https://github.com/advisories/GHSA-4vrv-93c7-m92j","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24441","https://github.com/snyk/snyk-eclipse-plugin/commit/b5a8bce25a359ced75f83a729fc6b2393fc9a495","https://github.com/snyk/snyk-intellij-plugin/commit/56682f4ba6081ce1d95cb980cbfacd3809a826f4","https://github.com/snyk/snyk-ls/commit/b3229f0142f782871aa72d1a7dcf417546d568ed","https://github.com/snyk/snyk-visual-studio-plugin/commit/0b53dbbd4a3153c3ef9aaf797af3b5caad0f731a","https://github.com/snyk/vscode-extension/commit/0db3b4240be0db6a0a5c6d02c0d4231a2c4ba708","https://security.snyk.io/vuln/SNYK-JS-SNYK-3111871","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution"],"description":"snyk Code Injection vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24441","epss":0.0076,"percentile":0.55298,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24441","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24441","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["1.1064.0"],"state":"fixed","available":[{"version":"1.1064.0","date":"2023-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.6194000000000001},"relatedVulnerabilities":[{"id":"CVE-2022-24441","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24441","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/snyk/snyk-eclipse-plugin/commit/b5a8bce25a359ced75f83a729fc6b2393fc9a495","https://github.com/snyk/snyk-intellij-plugin/commit/56682f4ba6081ce1d95cb980cbfacd3809a826f4","https://github.com/snyk/snyk-ls/commit/b3229f0142f782871aa72d1a7dcf417546d568ed","https://github.com/snyk/snyk-visual-studio-plugin/commit/0b53dbbd4a3153c3ef9aaf797af3b5caad0f731a","https://github.com/snyk/vscode-extension/commit/0db3b4240be0db6a0a5c6d02c0d4231a2c4ba708","https://security.snyk.io/vuln/SNYK-JS-SNYK-3111871","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","metrics":{"baseScore":5.8,"exploitabilityScore":1.7,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24441","epss":0.0076,"percentile":0.55298,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24441","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24441","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"snyk","version":"1.0.0-monorepo"}},"found":{"vulnerabilityID":"GHSA-4vrv-93c7-m92j","versionConstraint":"<1.1064.0 (semantic)"},"fix":{"suggestedVersion":"1.1064.0"}}],"artifact":{"id":"pkg:npm/snyk@1.0.0-monorepo?package-id=846527b067d5b74a","name":"snyk","version":"1.0.0-monorepo","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:snyk:snyk:1.0.0-monorepo:*:*:*:*:*:*:*"],"purl":"pkg:npm/snyk@1.0.0-monorepo","upstreams":[]}},{"vulnerability":{"id":"GHSA-rhx6-c78j-4q9w","dataSource":"https://github.com/advisories/GHSA-rhx6-c78j-4q9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w","https://blakeembrey.com/posts/2024-09-web-redos","https://nvd.nist.gov/vuln/detail/CVE-2024-52798","https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4","https://security.netapp.com/advisory/ntap-20250124-0002"],"description":"path-to-regexp contains a ReDoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-52798","epss":0.00787,"percentile":0.56157,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-52798","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.1.12"],"state":"fixed","available":[{"version":"0.1.12","date":"2024-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.5941850000000001},"relatedVulnerabilities":[{"id":"CVE-2024-52798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52798","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w","https://security.netapp.com/advisory/ntap-20250124-0002/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-52798","epss":0.00787,"percentile":0.56157,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-52798","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-rhx6-c78j-4q9w","versionConstraint":"<0.1.12 (semantic)"},"fix":{"suggestedVersion":"0.1.12"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=930ccf3090d13a40","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-76p7-773f-r4q5","dataSource":"https://github.com/advisories/GHSA-76p7-773f-r4q5","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-11831","https://github.com/yahoo/serialize-javascript/pull/173","https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e","https://access.redhat.com/security/cve/CVE-2024-11831","https://bugzilla.redhat.com/show_bug.cgi?id=2312579","https://access.redhat.com/errata/RHSA-2025:1334","https://access.redhat.com/errata/RHSA-2025:1468","https://github.com/yahoo/serialize-javascript/commit/7f3ac252d86b802454cb43782820aea2e0f6dc25","https://access.redhat.com/errata/RHBA-2025:0304","https://access.redhat.com/errata/RHSA-2025:4511","https://access.redhat.com/errata/RHSA-2025:8059","https://access.redhat.com/errata/RHSA-2025:8479","https://access.redhat.com/errata/RHSA-2025:8544","https://access.redhat.com/errata/RHSA-2025:8551","https://access.redhat.com/errata/RHSA-2025:21068","https://access.redhat.com/errata/RHSA-2025:21203","https://access.redhat.com/errata/RHSA-2025:9294","https://access.redhat.com/errata/RHSA-2025:8078","https://access.redhat.com/errata/RHSA-2025:10853","https://access.redhat.com/errata/RHSA-2025:8512","https://access.redhat.com/errata/RHSA-2025:8233","https://access.redhat.com/errata/RHSA-2025:3870","https://access.redhat.com/errata/RHSA-2025:0381","https://access.redhat.com/errata/RHSA-2026:1536","https://access.redhat.com/errata/RHSA-2026:2769","https://access.redhat.com/errata/RHSA-2026:8568","https://access.redhat.com/errata/RHSA-2026:62115","https://access.redhat.com/errata/RHSA-2026:83548"],"description":"Cross-site Scripting (XSS) in serialize-javascript","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11831","epss":0.01122,"percentile":0.66225,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-11831","cwe":"CWE-79","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":["6.0.2"],"state":"fixed","available":[{"version":"6.0.2","date":"2025-02-11","kind":"first-observed"}]},"advisories":[],"risk":0.5834400000000001},"relatedVulnerabilities":[{"id":"CVE-2024-11831","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11831","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHBA-2025:0304","https://access.redhat.com/errata/RHSA-2025:0381","https://access.redhat.com/errata/RHSA-2025:10853","https://access.redhat.com/errata/RHSA-2025:1334","https://access.redhat.com/errata/RHSA-2025:1468","https://access.redhat.com/errata/RHSA-2025:21068","https://access.redhat.com/errata/RHSA-2025:21203","https://access.redhat.com/errata/RHSA-2025:3870","https://access.redhat.com/errata/RHSA-2025:4511","https://access.redhat.com/errata/RHSA-2025:8059","https://access.redhat.com/errata/RHSA-2025:8078","https://access.redhat.com/errata/RHSA-2025:8233","https://access.redhat.com/errata/RHSA-2025:8479","https://access.redhat.com/errata/RHSA-2025:8512","https://access.redhat.com/errata/RHSA-2025:8544","https://access.redhat.com/errata/RHSA-2025:8551","https://access.redhat.com/errata/RHSA-2025:9294","https://access.redhat.com/errata/RHSA-2026:1536","https://access.redhat.com/errata/RHSA-2026:2769","https://access.redhat.com/errata/RHSA-2026:62115","https://access.redhat.com/errata/RHSA-2026:83548","https://access.redhat.com/errata/RHSA-2026:8568","https://access.redhat.com/security/cve/CVE-2024-11831","https://bugzilla.redhat.com/show_bug.cgi?id=2312579","https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e","https://github.com/yahoo/serialize-javascript/pull/173"],"description":"A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11831","epss":0.01122,"percentile":0.66225,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-11831","cwe":"CWE-79","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.0"}},"found":{"vulnerabilityID":"GHSA-76p7-773f-r4q5","versionConstraint":">=6.0.0,<6.0.2 (semantic)"},"fix":{"suggestedVersion":"6.0.2"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.0?package-id=64612a3ac0f67076","name":"serialize-javascript","version":"6.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.0:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3mfm-83xf-c92r","dataSource":"https://github.com/advisories/GHSA-3mfm-83xf-c92r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33938"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33938","epss":0.00721,"percentile":0.5398,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33938","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-917","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.56238},"relatedVulnerabilities":[{"id":"CVE-2026-33938","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33938","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33938","https://bugzilla.redhat.com/show_bug.cgi?id=2452525","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33938.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). The `compile()` method is  absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers  should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in  contexts where templates or context data can be influenced by untrusted input.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33938","epss":0.00721,"percentile":0.5398,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33938","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-917","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-3mfm-83xf-c92r","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhpv-hc6g-r9c6","dataSource":"https://github.com/advisories/GHSA-xhpv-hc6g-r9c6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33940"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33940","epss":0.00715,"percentile":0.53771,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.5577000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33940","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33940","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33940","https://bugzilla.redhat.com/show_bug.cgi?id=2452521","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33940.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). Without `compile()`,  the fallback compilation path in `invokePartial` is unreachable. Second, sanitize context data before rendering: Ensure no value in the context is a non-primitive  object that could be passed to a dynamic partial. Third, avoid dynamic partial lookups (`{{> (lookup ...)}}`) when context data is user-controlled.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33940","epss":0.00715,"percentile":0.53771,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-xhpv-hc6g-r9c6","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-3x93-p86w-5jvh","dataSource":"https://github.com/advisories/GHSA-3x93-p86w-5jvh","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-16629","https://github.com/danger/danger-js/pull/1513","https://github.com/danger/danger-js/commit/087a7290264cc6fb7154ea8c2552a7b2cb8b33a3","https://github.com/danger/danger-js","https://github.com/danger/danger-js/releases/tag/13.0.8","https://vuldb.com/cve/CVE-2026-16629","https://vuldb.com/submit/860211","https://vuldb.com/vuln/382377","https://vuldb.com/vuln/382377/cti"],"description":"danger allows local OS command injection through crafted file paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16629","epss":0.01083,"percentile":0.65202,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16629","cwe":"CWE-77","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-16629","cwe":"CWE-78","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["13.0.8"],"state":"fixed","available":[{"version":"13.0.8","date":"2026-09-05","kind":"first-observed"}]},"advisories":[],"risk":0.5442075},"relatedVulnerabilities":[{"id":"CVE-2026-16629","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16629","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/danger/danger-js/","https://github.com/danger/danger-js/commit/087a7290264cc6fb7154ea8c2552a7b2cb8b33a3","https://github.com/danger/danger-js/pull/1513","https://github.com/danger/danger-js/releases/tag/13.0.8","https://vuldb.com/cve/CVE-2026-16629","https://vuldb.com/submit/860211","https://vuldb.com/vuln/382377","https://vuldb.com/vuln/382377/cti"],"description":"A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":3.2,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16629","epss":0.01083,"percentile":0.65202,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16629","cwe":"CWE-77","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-16629","cwe":"CWE-78","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"danger","version":"10.9.0"}},"found":{"vulnerabilityID":"GHSA-3x93-p86w-5jvh","versionConstraint":"<13.0.8 (semantic)"},"fix":{"suggestedVersion":"13.0.8"}}],"artifact":{"id":"pkg:npm/danger@10.9.0?package-id=94d3e968740774e1","name":"danger","version":"10.9.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:danger:danger:10.9.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/danger@10.9.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4vvj-4cpr-p986","dataSource":"https://github.com/advisories/GHSA-4vvj-4cpr-p986","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986","https://nvd.nist.gov/vuln/detail/CVE-2024-43788","https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61","https://research.securitum.com/xss-in-amp4email-dom-clobbering","https://scnps.co/papers/sp23_domclob.pdf","https://github.com/webpack/webpack/issues/18718#issuecomment-2326296270"],"description":"Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43788","epss":0.00959,"percentile":0.61507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43788","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-43788","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["5.94.0"],"state":"fixed","available":[{"version":"5.94.0","date":"2024-08-28","kind":"first-observed"}]},"advisories":[],"risk":0.5394375},"relatedVulnerabilities":[{"id":"CVE-2024-43788","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43788","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61","https://github.com/webpack/webpack/issues/18718#issuecomment-2326296270","https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986","https://research.securitum.com/xss-in-amp4email-dom-clobbering","https://scnps.co/papers/sp23_domclob.pdf"],"description":"Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43788","epss":0.00959,"percentile":0.61507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43788","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-43788","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack","version":"5.54.0"}},"found":{"vulnerabilityID":"GHSA-4vvj-4cpr-p986","versionConstraint":">=5.0.0-alpha.0,<5.94.0 (semantic)"},"fix":{"suggestedVersion":"5.94.0"}}],"artifact":{"id":"pkg:npm/webpack@5.54.0?package-id=a0c270983ec54e9c","name":"webpack","version":"5.54.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack.js:webpack:5.54.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/webpack@5.54.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p8wg-vrv2-v86f","dataSource":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f","https://nvd.nist.gov/vuln/detail/CVE-2026-106445","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via Own Property Check Bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106445","epss":0.00589,"percentile":0.48165,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.53599},"relatedVulnerabilities":[{"id":"CVE-2026-106445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106445","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106445","epss":0.00589,"percentile":0.48165,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-p8wg-vrv2-v86f","versionConstraint":">=3.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-hmw2-7cc7-3qxx","dataSource":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://nvd.nist.gov/vuln/detail/CVE-2026-12143","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data"],"description":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["2.5.6"],"state":"fixed","available":[{"version":"2.5.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.5218200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-12143","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","namespace":"nvd:cpe","severity":"High","urls":["https://cwe.mitre.org/data/definitions/93.html","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54770","https://access.redhat.com/errata/RHSA-2026:56338","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59136","https://access.redhat.com/errata/RHSA-2026:59153","https://access.redhat.com/errata/RHSA-2026:59155","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60389","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63355","https://access.redhat.com/errata/RHSA-2026:63373","https://access.redhat.com/errata/RHSA-2026:66003","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-12143","https://bugzilla.redhat.com/show_bug.cgi?id=2488480","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json"],"description":"form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"2.5.1"}},"found":{"vulnerabilityID":"GHSA-hmw2-7cc7-3qxx","versionConstraint":"<2.5.6 (semantic)"},"fix":{"suggestedVersion":"2.5.6"}}],"artifact":{"id":"pkg:npm/form-data@2.5.1?package-id=010767d5ac04716e","name":"form-data","version":"2.5.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:form-data:form-data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:2.5.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@2.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4c8g-83qw-93j6","dataSource":"https://github.com/advisories/GHSA-4c8g-83qw-93j6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://nvd.nist.gov/vuln/detail/CVE-2026-13676","https://github.com/fastify/fast-uri/pull/188","https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05","https://github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd","https://github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json","https://github.com/fastify/fast-uri/releases/tag/v4.0.1","https://github.com/fastify/fast-uri/releases/tag/v3.1.3","https://github.com/fastify/fast-uri/releases/tag/v2.4.2","https://cna.openjsf.org/security-advisories.html","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://access.redhat.com/security/cve/CVE-2026-13676","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545"],"description":"fast-uri vulnerable to host confusion via failed IDN canonicalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13676","epss":0.00692,"percentile":0.52908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13676","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-13676","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.519},"relatedVulnerabilities":[{"id":"CVE-2026-13676","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40765","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:42815","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44239","https://access.redhat.com/errata/RHSA-2026:44268","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48126","https://access.redhat.com/errata/RHSA-2026:49642","https://access.redhat.com/errata/RHSA-2026:50340","https://access.redhat.com/errata/RHSA-2026:50479","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:51196","https://access.redhat.com/errata/RHSA-2026:51197","https://access.redhat.com/errata/RHSA-2026:51342","https://access.redhat.com/errata/RHSA-2026:51348","https://access.redhat.com/errata/RHSA-2026:51349","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63371","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-13676","https://bugzilla.redhat.com/show_bug.cgi?id=2494197","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json"],"description":"fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13676","epss":0.00692,"percentile":0.52908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13676","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-13676","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-4c8g-83qw-93j6","versionConstraint":">=3.0.0,<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-23hp-3jrh-7fpw","dataSource":"https://github.com/advisories/GHSA-23hp-3jrh-7fpw","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","https://nvd.nist.gov/vuln/detail/CVE-2026-59873","https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19"],"description":"node-tar: Decompression/parse DoS via unlimited input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.19"],"state":"fixed","available":[{"version":"7.5.19","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.5048849999999999},"relatedVulnerabilities":[{"id":"CVE-2026-59873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19","https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-23hp-3jrh-7fpw","versionConstraint":"<=7.5.18 (semantic)"},"fix":{"suggestedVersion":"7.5.19"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7fh5-64p2-3v2j","dataSource":"https://github.com/advisories/GHSA-7fh5-64p2-3v2j","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-44270","https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5","https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25","https://github.com/postcss/postcss/releases/tag/8.4.31","https://github.com/github/advisory-database/issues/2820","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"],"description":"PostCSS line return parsing error","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-44270","epss":0.00973,"percentile":0.62033,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-44270","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["8.4.31"],"state":"fixed","available":[{"version":"8.4.31","date":"2023-10-04","kind":"first-observed"}]},"advisories":[],"risk":0.5010950000000001},"relatedVulnerabilities":[{"id":"CVE-2023-44270","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44270","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/github/advisory-database/issues/2820","https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25","https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5","https://github.com/postcss/postcss/releases/tag/8.4.31","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"],"description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-44270","epss":0.00973,"percentile":0.62033,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-44270","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.3.6"}},"found":{"vulnerabilityID":"GHSA-7fh5-64p2-3v2j","versionConstraint":"<8.4.31 (semantic)"},"fix":{"suggestedVersion":"8.4.31"}}],"artifact":{"id":"pkg:npm/postcss@8.3.6?package-id=d60537998490ed6d","name":"postcss","version":"8.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.21.5"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.21.5?package-id=b72fb7a0d0ddf8a4","name":"browserslist","version":"4.21.5","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.21.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.21.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.23.0"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.23.0?package-id=0c6e4df33c13441e","name":"browserslist","version":"4.23.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.23.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.23.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.21.5"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.21.5?package-id=b72fb7a0d0ddf8a4","name":"browserslist","version":"4.21.5","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.21.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.21.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.23.0"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.23.0?package-id=0c6e4df33c13441e","name":"browserslist","version":"4.23.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.23.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.23.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2e059e5e7365de9a","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2e059e5e7365de9a","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-67hx-6x53-jw92","dataSource":"https://github.com/advisories/GHSA-67hx-6x53-jw92","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://nvd.nist.gov/vuln/detail/CVE-2023-45133","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://www.debian.org/security/2023/dsa-5528","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://babeljs.io/blog/2023/10/16/cve-2023-45133"],"description":"Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.23.2"],"state":"fixed","available":[{"version":"7.23.2","date":"2023-10-17","kind":"first-observed"}]},"advisories":[],"risk":0.48037500000000005},"relatedVulnerabilities":[{"id":"CVE-2023-45133","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45133","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://www.debian.org/security/2023/dsa-5528"],"description":"Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/traverse","version":"7.20.13"}},"found":{"vulnerabilityID":"GHSA-67hx-6x53-jw92","versionConstraint":"<7.23.2 (semantic)"},"fix":{"suggestedVersion":"7.23.2"}}],"artifact":{"id":"pkg:npm/%40babel/traverse@7.20.13?package-id=98face2009d88868","name":"@babel/traverse","version":"7.20.13","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/traverse:\\@babel\\/traverse:7.20.13:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/traverse@7.20.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-01-29","kind":"first-observed"}]},"advisories":[],"risk":0.47728},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-24842","https://bugzilla.redhat.com/show_bug.cgi?id=2433645","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3j6-qgpj-74h6","dataSource":"https://github.com/advisories/GHSA-q3j6-qgpj-74h6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","https://nvd.nist.gov/vuln/detail/CVE-2026-6321","https://cna.openjsf.org/security-advisories.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json","https://github.com/fastify/fast-uri/releases/tag/v3.1.1","https://github.com/fastify/fast-uri/releases/tag/v2.4.1","https://bugzilla.redhat.com/show_bug.cgi?id=2466582","https://access.redhat.com/security/cve/CVE-2026-6321","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26416","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:24866","https://access.redhat.com/errata/RHSA-2026:24766","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:19238","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:56928"],"description":"fast-uri vulnerable to path traversal via percent-encoded dot segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6321","epss":0.00634,"percentile":0.50399,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6321","cwe":"CWE-22","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-6321","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.1.1"],"state":"fixed","available":[{"version":"3.1.1","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.47550000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-6321","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","https://access.redhat.com/errata/RHSA-2026:19238","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:24766","https://access.redhat.com/errata/RHSA-2026:24866","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25123","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:26416","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/security/cve/CVE-2026-6321","https://bugzilla.redhat.com/show_bug.cgi?id=2466582","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6321.json"],"description":"fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6321","epss":0.00634,"percentile":0.50399,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6321","cwe":"CWE-22","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-6321","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-q3j6-qgpj-74h6","versionConstraint":">=3.0.0,<=3.1.0 (semantic)"},"fix":{"suggestedVersion":"3.1.1"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-9cx6-37pm-9jff","dataSource":"https://github.com/advisories/GHSA-9cx6-37pm-9jff","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33939"],"description":"Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33939","epss":0.00627,"percentile":0.50068,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33939","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33939","cwe":"CWE-248","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-33939","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33939","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33939","https://bugzilla.redhat.com/show_bug.cgi?id=2452508","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33939.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, \"n\")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing  decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled  templates; do not call `compile()` at request time.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33939","epss":0.00627,"percentile":0.50068,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33939","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33939","cwe":"CWE-248","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-9cx6-37pm-9jff","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-8cj5-5rvv-wf4v","dataSource":"https://github.com/advisories/GHSA-8cj5-5rvv-wf4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v","https://nvd.nist.gov/vuln/detail/CVE-2025-48387","https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f","https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w","https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html"],"description":"tar-fs can extract outside the specified dir with a specific tarball","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-48387","epss":0.00579,"percentile":0.47662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-48387","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.3"],"state":"fixed","available":[{"version":"2.1.3","date":"2025-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.46898999999999996},"relatedVulnerabilities":[{"id":"CVE-2025-48387","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48387","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w","https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f","https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v","https://lists.debian.org/debian-lts-announce/2025/06/msg00012.html"],"description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-48387","epss":0.00579,"percentile":0.47662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-48387","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar-fs","version":"2.1.1"}},"found":{"vulnerabilityID":"GHSA-8cj5-5rvv-wf4v","versionConstraint":">=2.0.0,<2.1.3 (semantic)"},"fix":{"suggestedVersion":"2.1.3"}}],"artifact":{"id":"pkg:npm/tar-fs@2.1.1?package-id=2dc9b2bde2da6ab0","name":"tar-fs","version":"2.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:tar-fs:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar_fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar_fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar_fs:2.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/tar-fs@2.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-hpqj-7cj6-hfj8","dataSource":"https://github.com/advisories/GHSA-hpqj-7cj6-hfj8","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-40764","https://github.com/snyk/cli/releases/tag/v1.996.0","https://github.com/snyk/snyk-go-plugin/releases/tag/v1.19.1","https://support.snyk.io/hc/en-us/articles/7015908293789-CVE-2022-40764-Command-Injection-vulnerability-affecting-Snyk-CLI-versions-prior-to-1-996-0","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"Snyk CLI affected by Command Injection vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-40764","epss":0.00612,"percentile":0.4931,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-40764","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.996.0"],"state":"fixed","available":[{"version":"1.996.0","date":"2022-10-07","kind":"first-observed"}]},"advisories":[],"risk":0.46818},"relatedVulnerabilities":[{"id":"CVE-2022-40764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40764","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/snyk/cli/releases/tag/v1.996.0","https://github.com/snyk/snyk-go-plugin/releases/tag/v1.19.1","https://support.snyk.io/hc/en-us/articles/7015908293789-CVE-2022-40764-Command-Injection-vulnerability-affecting-Snyk-CLI-versions-prior-to-1-996-0","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-40764","epss":0.00612,"percentile":0.4931,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-40764","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"snyk","version":"1.0.0-monorepo"}},"found":{"vulnerabilityID":"GHSA-hpqj-7cj6-hfj8","versionConstraint":"<1.996.0 (semantic)"},"fix":{"suggestedVersion":"1.996.0"}}],"artifact":{"id":"pkg:npm/snyk@1.0.0-monorepo?package-id=e49646e4373d0b2b","name":"snyk","version":"1.0.0-monorepo","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:snyk:snyk:1.0.0-monorepo:*:*:*:*:*:*:*"],"purl":"pkg:npm/snyk@1.0.0-monorepo","upstreams":[]}},{"vulnerability":{"id":"GHSA-hpqj-7cj6-hfj8","dataSource":"https://github.com/advisories/GHSA-hpqj-7cj6-hfj8","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-40764","https://github.com/snyk/cli/releases/tag/v1.996.0","https://github.com/snyk/snyk-go-plugin/releases/tag/v1.19.1","https://support.snyk.io/hc/en-us/articles/7015908293789-CVE-2022-40764-Command-Injection-vulnerability-affecting-Snyk-CLI-versions-prior-to-1-996-0","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"Snyk CLI affected by Command Injection vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-40764","epss":0.00612,"percentile":0.4931,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-40764","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.996.0"],"state":"fixed","available":[{"version":"1.996.0","date":"2022-10-07","kind":"first-observed"}]},"advisories":[],"risk":0.46818},"relatedVulnerabilities":[{"id":"CVE-2022-40764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40764","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/snyk/cli/releases/tag/v1.996.0","https://github.com/snyk/snyk-go-plugin/releases/tag/v1.19.1","https://support.snyk.io/hc/en-us/articles/7015908293789-CVE-2022-40764-Command-Injection-vulnerability-affecting-Snyk-CLI-versions-prior-to-1-996-0","https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/"],"description":"Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-40764","epss":0.00612,"percentile":0.4931,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-40764","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"snyk","version":"1.0.0-monorepo"}},"found":{"vulnerabilityID":"GHSA-hpqj-7cj6-hfj8","versionConstraint":"<1.996.0 (semantic)"},"fix":{"suggestedVersion":"1.996.0"}}],"artifact":{"id":"pkg:npm/snyk@1.0.0-monorepo?package-id=846527b067d5b74a","name":"snyk","version":"1.0.0-monorepo","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:snyk:snyk:1.0.0-monorepo:*:*:*:*:*:*:*"],"purl":"pkg:npm/snyk@1.0.0-monorepo","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=9838fb0cc6ec7421","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.6"],"state":"fixed","available":[{"version":"9.0.6","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":">=9.0.0,<9.0.6 (semantic)"},"fix":{"suggestedVersion":"9.0.6"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=224f6ad7dca47ee8","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g55-p6wh-862q","dataSource":"https://github.com/advisories/GHSA-6g55-p6wh-862q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad","https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3","https://github.com/postcss/postcss/releases/tag/8.5.12"],"description":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["8.5.12"],"state":"fixed","available":[{"version":"8.5.12","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.45599999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-45623","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.3.6"}},"found":{"vulnerabilityID":"GHSA-6g55-p6wh-862q","versionConstraint":"<=8.5.11 (semantic)"},"fix":{"suggestedVersion":"8.5.12"}}],"artifact":{"id":"pkg:npm/postcss@8.3.6?package-id=d60537998490ed6d","name":"postcss","version":"8.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-vj76-c3g6-qr5v","dataSource":"https://github.com/advisories/GHSA-vj76-c3g6-qr5v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","https://nvd.nist.gov/vuln/detail/CVE-2025-59343","https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"],"description":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00553,"percentile":0.46203,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-59343","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-59343","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2025-09-27","kind":"first-observed"}]},"advisories":[],"risk":0.44792999999999994},"relatedVulnerabilities":[{"id":"CVE-2025-59343","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59343","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"],"description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00553,"percentile":0.46203,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-59343","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-59343","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar-fs","version":"2.1.1"}},"found":{"vulnerabilityID":"GHSA-vj76-c3g6-qr5v","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"pkg:npm/tar-fs@2.1.1?package-id=2dc9b2bde2da6ab0","name":"tar-fs","version":"2.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:tar-fs:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar_fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar_fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar-fs:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar_fs:2.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/tar-fs@2.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=3.0.0,<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=a9efc5a07e1f6ee7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rv95-896h-c2vc","dataSource":"https://github.com/advisories/GHSA-rv95-896h-c2vc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","https://github.com/koajs/koa/issues/1800","https://github.com/expressjs/express/pull/5539","https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","https://expressjs.com/en/4x/api.html#res.location","https://nvd.nist.gov/vuln/detail/CVE-2024-29041"],"description":"Express.js Open Redirect in malformed URLs","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29041","epss":0.00786,"percentile":0.56127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-29041","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-29041","cwe":"CWE-1286","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.19.2"],"state":"fixed","available":[{"version":"4.19.2","date":"2024-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.43622999999999995},"relatedVulnerabilities":[{"id":"CVE-2024-29041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29041","namespace":"nvd:cpe","severity":"Medium","urls":["https://expressjs.com/en/4x/api.html#res.location","https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","https://github.com/expressjs/express/pull/5539","https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","https://github.com/koajs/koa/issues/1800"],"description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29041","epss":0.00786,"percentile":0.56127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-29041","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-29041","cwe":"CWE-1286","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express","version":"4.17.1"}},"found":{"vulnerabilityID":"GHSA-rv95-896h-c2vc","versionConstraint":"<4.19.2 (semantic)"},"fix":{"suggestedVersion":"4.19.2"}}],"artifact":{"id":"pkg:npm/express@4.17.1?package-id=79d3c1dfb6449b7a","name":"express","version":"4.17.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:express:4.17.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express@4.17.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=9838fb0cc6ec7421","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=224f6ad7dca47ee8","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-8cf7-32gw-wr33","dataSource":"https://github.com/advisories/GHSA-8cf7-32gw-wr33","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23539","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken unrestricted key type could lead to legacy keys usage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00524,"percentile":0.44467,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.40872},"relatedVulnerabilities":[{"id":"CVE-2022-23539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23539","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and/or `verify()` functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00524,"percentile":0.44467,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"8.5.1"}},"found":{"vulnerabilityID":"GHSA-8cf7-32gw-wr33","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"pkg:npm/jsonwebtoken@8.5.1?package-id=843af9e4e681d1cb","name":"jsonwebtoken","version":"8.5.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:8.5.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@8.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.2"],"state":"fixed","available":[{"version":"3.15.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=3.0.0,<3.15.2 (semantic)"},"fix":{"suggestedVersion":"3.15.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=a9efc5a07e1f6ee7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-hjrf-2m68-5959","dataSource":"https://github.com/advisories/GHSA-hjrf-2m68-5959","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23541","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0081,"percentile":0.56921,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.40499999999999997},"relatedVulnerabilities":[{"id":"CVE-2022-23541","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23541","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of  forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0081,"percentile":0.56921,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"8.5.1"}},"found":{"vulnerabilityID":"GHSA-hjrf-2m68-5959","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"pkg:npm/jsonwebtoken@8.5.1?package-id=843af9e4e681d1cb","name":"jsonwebtoken","version":"8.5.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:8.5.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@8.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rmvr-2pp2-xj38","dataSource":"https://github.com/advisories/GHSA-rmvr-2pp2-xj38","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38","https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68","https://nvd.nist.gov/vuln/detail/CVE-2025-25290","https://github.com/octokit/request.js/releases/tag/v8.4.1","https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2","https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c","https://github.com/octokit/request.js/releases/tag/v9.2.1"],"description":"@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25290","epss":0.00783,"percentile":0.56031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25290","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.4.1"],"state":"fixed","available":[{"version":"8.4.1","date":"2025-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.40324499999999996},"relatedVulnerabilities":[{"id":"CVE-2025-25290","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25290","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68","https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2","https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c","https://github.com/octokit/request.js/releases/tag/v8.4.1","https://github.com/octokit/request.js/releases/tag/v9.2.1","https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38"],"description":"@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/<([^>]+)>; rel=\"deprecation\"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25290","epss":0.00783,"percentile":0.56031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25290","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@octokit/request","version":"5.6.1"}},"found":{"vulnerabilityID":"GHSA-rmvr-2pp2-xj38","versionConstraint":">=1.0.0,<8.4.1 (semantic)"},"fix":{"suggestedVersion":"8.4.1"}}],"artifact":{"id":"pkg:npm/%40octokit/request@5.6.1?package-id=415e0942cabfa690","name":"@octokit/request","version":"5.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@octokit\\/request:\\@octokit\\/request:5.6.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40octokit/request@5.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r292-9mhp-454m","dataSource":"https://github.com/advisories/GHSA-r292-9mhp-454m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/releases/tag/v7.5.21","https://nvd.nist.gov/vuln/detail/CVE-2026-73566"],"description":"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.21"],"state":"fixed","available":[{"version":"7.5.21","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.39825},"relatedVulnerabilities":[{"id":"CVE-2026-73566","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-r292-9mhp-454m","versionConstraint":"<=7.5.20 (semantic)"},"fix":{"suggestedVersion":"7.5.21"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r28c-9q8g-f849","dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.18"],"state":"fixed","available":[{"version":"8.5.18","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-73646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.3.6"}},"found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"fix":{"suggestedVersion":"8.5.18"}}],"artifact":{"id":"pkg:npm/postcss@8.3.6?package-id=d60537998490ed6d","name":"postcss","version":"8.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-6m8w-jc87-6cr7","dataSource":"https://github.com/advisories/GHSA-6m8w-jc87-6cr7","namespace":"github:language:go","severity":"High","urls":["https://github.com/open-policy-agent/opa/security/advisories/GHSA-6m8w-jc87-6cr7","https://github.com/open-policy-agent/opa/commit/ad2063247a14711882f18c387a511fc8094aa79c","https://nvd.nist.gov/vuln/detail/CVE-2025-46569","https://pkg.go.dev/vuln/GO-2025-3660"],"description":"OPA server Data API HTTP path injection of Rego","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":7.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-46569","epss":0.00532,"percentile":0.44966,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-46569","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-46569","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.0"],"state":"fixed","available":[{"version":"1.4.0","date":"2025-05-06","kind":"first-observed"}]},"advisories":[],"risk":0.39633999999999997},"relatedVulnerabilities":[{"id":"CVE-2025-46569","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46569","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/open-policy-agent/opa/commit/ad2063247a14711882f18c387a511fc8094aa79c","https://github.com/open-policy-agent/opa/security/advisories/GHSA-6m8w-jc87-6cr7"],"description":"Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA’s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-46569","epss":0.00532,"percentile":0.44966,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-46569","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-46569","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/open-policy-agent/opa","version":"v0.69.0"}},"found":{"vulnerabilityID":"GHSA-6m8w-jc87-6cr7","versionConstraint":"<1.4.0 (go)"},"fix":{"suggestedVersion":"1.4.0"}}],"artifact":{"id":"pkg:golang/github.com/open-policy-agent/opa@v0.69.0?package-id=34425ea0b49eb937","name":"github.com/open-policy-agent/opa","version":"v0.69.0","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:open-policy-agent:opa:v0.69.0:*:*:*:*:*:*:*","cpe:2.3:a:open_policy_agent:opa:v0.69.0:*:*:*:*:*:*:*","cpe:2.3:a:open-policy:opa:v0.69.0:*:*:*:*:*:*:*","cpe:2.3:a:open_policy:opa:v0.69.0:*:*:*:*:*:*:*","cpe:2.3:a:open:opa:v0.69.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/open-policy-agent/opa@v0.69.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:s2igLw2Z6IvGWGuXSfugWkVultDMsM9pXiDuMp7ckWw="}}},{"vulnerability":{"id":"GHSA-6m8w-jc87-6cr7","dataSource":"https://github.com/advisories/GHSA-6m8w-jc87-6cr7","namespace":"github:language:go","severity":"High","urls":["https://github.com/open-policy-agent/opa/security/advisories/GHSA-6m8w-jc87-6cr7","https://github.com/open-policy-agent/opa/commit/ad2063247a14711882f18c387a511fc8094aa79c","https://nvd.nist.gov/vuln/detail/CVE-2025-46569","https://pkg.go.dev/vuln/GO-2025-3660"],"description":"OPA server Data API HTTP path injection of Rego","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":7.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-46569","epss":0.00532,"percentile":0.44966,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-46569","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-46569","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.4.0"],"state":"fixed","available":[{"version":"1.4.0","date":"2025-05-06","kind":"first-observed"}]},"advisories":[],"risk":0.39633999999999997},"relatedVulnerabilities":[{"id":"CVE-2025-46569","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46569","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/open-policy-agent/opa/commit/ad2063247a14711882f18c387a511fc8094aa79c","https://github.com/open-policy-agent/opa/security/advisories/GHSA-6m8w-jc87-6cr7"],"description":"Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA’s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-46569","epss":0.00532,"percentile":0.44966,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-46569","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-46569","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/open-policy-agent/opa","version":"v0.69.0"}},"found":{"vulnerabilityID":"GHSA-6m8w-jc87-6cr7","versionConstraint":"<1.4.0 (go)"},"fix":{"suggestedVersion":"1.4.0"}}],"artifact":{"id":"pkg:golang/github.com/open-policy-agent/opa@v0.69.0?package-id=1f2017e17340cfa7","name":"github.com/open-policy-agent/opa","version":"v0.69.0","type":"go-module","locations":[{"path":"/cliv2/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:open-policy-agent:opa:v0.69.0:*:*:*:*:*:*:*","cpe:2.3:a:open_policy_agent:opa:v0.69.0:*:*:*:*:*:*:*","cpe:2.3:a:open-policy:opa:v0.69.0:*:*:*:*:*:*:*","cpe:2.3:a:open_policy:opa:v0.69.0:*:*:*:*:*:*:*","cpe:2.3:a:open:opa:v0.69.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/open-policy-agent/opa@v0.69.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:s2igLw2Z6IvGWGuXSfugWkVultDMsM9pXiDuMp7ckWw="}}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=9838fb0cc6ec7421","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.3"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.3?package-id=82a899b869f50d38","name":"minimatch","version":"3.1.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=224f6ad7dca47ee8","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-37ch-88jc-xwx2","dataSource":"https://github.com/advisories/GHSA-37ch-88jc-xwx2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2","https://nvd.nist.gov/vuln/detail/CVE-2026-4867","https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13"],"description":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["0.1.13"],"state":"fixed","available":[{"version":"0.1.13","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.38625},"relatedVulnerabilities":[{"id":"CVE-2026-4867","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4867","namespace":"nvd:cpe","severity":"High","urls":["https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j"],"description":"Impact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\nCustom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.\n\nWorkarounds:\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-37ch-88jc-xwx2","versionConstraint":"<0.1.13 (semantic)"},"fix":{"suggestedVersion":"0.1.13"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=930ccf3090d13a40","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-v39h-62p7-jpjc","dataSource":"https://github.com/advisories/GHSA-v39h-62p7-jpjc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","https://nvd.nist.gov/vuln/detail/CVE-2026-6322","https://cna.openjsf.org/security-advisories.html","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/security/cve/CVE-2026-6322","https://bugzilla.redhat.com/show_bug.cgi?id=2466684","https://github.com/fastify/fast-uri/releases/tag/v2.4.1","https://github.com/fastify/fast-uri/releases/tag/v3.1.2","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:29796","https://access.redhat.com/errata/RHSA-2026:29800","https://access.redhat.com/errata/RHSA-2026:29834","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:34770","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:56968","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60855","https://access.redhat.com/errata/RHSA-2026:61783"],"description":"fast-uri vulnerable to host confusion via percent-encoded authority delimiters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6322","epss":0.00512,"percentile":0.43677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6322","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-6322","cwe":"CWE-140","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.1.2"],"state":"fixed","available":[{"version":"3.1.2","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.38400000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-6322","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:29796","https://access.redhat.com/errata/RHSA-2026:29800","https://access.redhat.com/errata/RHSA-2026:29834","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:34770","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:37385","https://access.redhat.com/errata/RHSA-2026:37628","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:56968","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60855","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/security/cve/CVE-2026-6322","https://bugzilla.redhat.com/show_bug.cgi?id=2466684","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6322.json"],"description":"fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-6322","epss":0.00512,"percentile":0.43677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-6322","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-6322","cwe":"CWE-140","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-v39h-62p7-jpjc","versionConstraint":">=3.0.0,<=3.1.1 (semantic)"},"fix":{"suggestedVersion":"3.1.2"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-8g77-54rh-46hx","dataSource":"https://github.com/advisories/GHSA-8g77-54rh-46hx","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-25975","https://github.com/jonschlinkert/parse-git-config/issues/14"],"description":"Prototype Pollution Vulnerability in parse-git-config","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25975","epss":0.00473,"percentile":0.40906,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25975","cwe":"CWE-200","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.37130499999999994},"relatedVulnerabilities":[{"id":"CVE-2025-25975","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25975","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jonschlinkert/parse-git-config/issues/14"],"description":"An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25975","epss":0.00473,"percentile":0.40906,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25975","cwe":"CWE-200","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"parse-git-config","version":"2.0.3"}},"found":{"vulnerabilityID":"GHSA-8g77-54rh-46hx","versionConstraint":"<=3.0.0 (semantic)"}}],"artifact":{"id":"pkg:npm/parse-git-config@2.0.3?package-id=41c12f8806344c1a","name":"parse-git-config","version":"2.0.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:parse-git-config:parse-git-config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse-git-config:parse_git_config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse_git_config:parse-git-config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse_git_config:parse_git_config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse-git:parse-git-config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse-git:parse_git_config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse_git:parse-git-config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse_git:parse_git_config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse:parse-git-config:2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:parse:parse_git_config:2.0.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/parse-git-config@2.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2e059e5e7365de9a","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-qffp-2rhf-9h96","dataSource":"https://github.com/advisories/GHSA-qffp-2rhf-9h96","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://nvd.nist.gov/vuln/detail/CVE-2026-29786"],"description":"tar has Hardlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2026-03-05","kind":"first-observed"}]},"advisories":[],"risk":0.36580999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-29786","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29786","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://access.redhat.com/security/cve/CVE-2026-29786","https://bugzilla.redhat.com/show_bug.cgi?id=2445476","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29786.json"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.9,"impactScore":4},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-qffp-2rhf-9h96","versionConstraint":"<=7.5.9 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mwp4-54f8-5fhr","dataSource":"https://github.com/advisories/GHSA-mwp4-54f8-5fhr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"],"description":"ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69192","epss":0.00465,"percentile":0.40276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69192","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69192","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.3.1"],"state":"fixed","available":[{"version":"10.3.1","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.3534},"relatedVulnerabilities":[{"id":"CVE-2026-69192","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69192","epss":0.00465,"percentile":0.40276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69192","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69192","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-mwp4-54f8-5fhr","versionConstraint":"<=10.3.0 (semantic)"},"fix":{"suggestedVersion":"10.3.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=3482994ca41f788f","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-58qx-3vcg-4xpx","dataSource":"https://github.com/advisories/GHSA-58qx-3vcg-4xpx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://nvd.nist.gov/vuln/detail/CVE-2026-45736","https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"],"description":"ws: Uninitialized memory disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45736","epss":0.00745,"percentile":0.54803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45736","cwe":"CWE-908","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45736","cwe":"CWE-824","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["8.20.1"],"state":"fixed","available":[{"version":"8.20.1","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.35015},"relatedVulnerabilities":[{"id":"CVE-2026-45736","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://access.redhat.com/errata/RHSA-2026:26638","https://access.redhat.com/errata/RHSA-2026:26994","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40768","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/errata/RHSA-2026:7655","https://access.redhat.com/security/cve/CVE-2026-45736","https://bugzilla.redhat.com/show_bug.cgi?id=2477914","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json"],"description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45736","epss":0.00745,"percentile":0.54803,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45736","cwe":"CWE-908","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45736","cwe":"CWE-824","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"8.17.0"}},"found":{"vulnerabilityID":"GHSA-58qx-3vcg-4xpx","versionConstraint":">=8.0.0,<8.20.1 (semantic)"},"fix":{"suggestedVersion":"8.20.1"}}],"artifact":{"id":"pkg:npm/ws@8.17.0?package-id=f7ba73e96444723e","name":"ws","version":"8.17.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:8.17.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@8.17.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2e059e5e7365de9a","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-8x88-c5mf-7j5w","dataSource":"https://github.com/advisories/GHSA-8x88-c5mf-7j5w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://nvd.nist.gov/vuln/detail/CVE-2026-59874","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Negative tar entry size causes infinite loop in archive replace","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33852},"relatedVulnerabilities":[{"id":"CVE-2026-59874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-8x88-c5mf-7j5w","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8wr-v893-vjvp","dataSource":"https://github.com/advisories/GHSA-w8wr-v893-vjvp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","https://nvd.nist.gov/vuln/detail/CVE-2026-59871","https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Process crash via PAX numeric path type confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33166},"relatedVulnerabilities":[{"id":"CVE-2026-59871","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-w8wr-v893-vjvp","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.33"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.0.33?package-id=b9ba4353f73079ce","name":"tmp","version":"0.0.33","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:raszi:tmp:0.0.33:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.33","upstreams":[]}},{"vulnerability":{"id":"GHSA-v2hh-gcrm-f6hx","dataSource":"https://github.com/advisories/GHSA-v2hh-gcrm-f6hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","https://nvd.nist.gov/vuln/detail/CVE-2026-16221","https://github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057","https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353","https://github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.3","https://github.com/fastify/fast-uri/releases/tag/v3.1.4","https://github.com/fastify/fast-uri/releases/tag/v4.1.1"],"description":"fast-uri vulnerable to host confusion via literal backslash authority delimiter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16221","epss":0.00436,"percentile":0.37868,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16221","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.327},"relatedVulnerabilities":[{"id":"CVE-2026-16221","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx"],"description":"Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. \n\nPatches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.\n\nWorkarounds: none.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-16221","epss":0.00436,"percentile":0.37868,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-16221","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-v2hh-gcrm-f6hx","versionConstraint":">=3.0.0,<=3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwph-4952-7xr6","dataSource":"https://github.com/advisories/GHSA-qwph-4952-7xr6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23540","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00572,"percentile":0.47297,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2022-12-23","kind":"first-observed"}]},"advisories":[],"risk":0.32604000000000005},"relatedVulnerabilities":[{"id":"CVE-2022-23540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23540","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00572,"percentile":0.47297,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"8.5.1"}},"found":{"vulnerabilityID":"GHSA-qwph-4952-7xr6","versionConstraint":"<9.0.0 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"pkg:npm/jsonwebtoken@8.5.1?package-id=843af9e4e681d1cb","name":"jsonwebtoken","version":"8.5.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:8.5.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@8.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h5c3-5r3r-rr8q","dataSource":"https://github.com/advisories/GHSA-h5c3-5r3r-rr8q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q","https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab","https://nvd.nist.gov/vuln/detail/CVE-2025-25288","https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts","https://github.com/octokit/plugin-paginate-rest.js/releases/tag/v9.2.2"],"description":"@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25288","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25288","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.2.2"],"state":"fixed","available":[{"version":"9.2.2","date":"2025-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.32342},"relatedVulnerabilities":[{"id":"CVE-2025-25288","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25288","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts","https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab","https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q"],"description":"@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25288","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25288","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@octokit/plugin-paginate-rest","version":"1.1.2"}},"found":{"vulnerabilityID":"GHSA-h5c3-5r3r-rr8q","versionConstraint":">=1.0.0,<9.2.2 (semantic)"},"fix":{"suggestedVersion":"9.2.2"}}],"artifact":{"id":"pkg:npm/%40octokit/plugin-paginate-rest@1.1.2?package-id=562affc451ccb236","name":"@octokit/plugin-paginate-rest","version":"1.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@octokit\\/plugin-paginate-rest:\\@octokit\\/plugin-paginate-rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate-rest:\\@octokit\\/plugin_paginate_rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate_rest:\\@octokit\\/plugin-paginate-rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate_rest:\\@octokit\\/plugin_paginate_rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate:\\@octokit\\/plugin-paginate-rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate:\\@octokit\\/plugin_paginate_rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate:\\@octokit\\/plugin-paginate-rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate:\\@octokit\\/plugin_paginate_rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin:\\@octokit\\/plugin-paginate-rest:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin:\\@octokit\\/plugin_paginate_rest:1.1.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40octokit/plugin-paginate-rest@1.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-h5c3-5r3r-rr8q","dataSource":"https://github.com/advisories/GHSA-h5c3-5r3r-rr8q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q","https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab","https://nvd.nist.gov/vuln/detail/CVE-2025-25288","https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts","https://github.com/octokit/plugin-paginate-rest.js/releases/tag/v9.2.2"],"description":"@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25288","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25288","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.2.2"],"state":"fixed","available":[{"version":"9.2.2","date":"2025-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.32342},"relatedVulnerabilities":[{"id":"CVE-2025-25288","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25288","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts","https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab","https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q"],"description":"@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25288","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25288","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@octokit/plugin-paginate-rest","version":"2.21.3"}},"found":{"vulnerabilityID":"GHSA-h5c3-5r3r-rr8q","versionConstraint":">=1.0.0,<9.2.2 (semantic)"},"fix":{"suggestedVersion":"9.2.2"}}],"artifact":{"id":"pkg:npm/%40octokit/plugin-paginate-rest@2.21.3?package-id=a201bd5ecb4e28a0","name":"@octokit/plugin-paginate-rest","version":"2.21.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@octokit\\/plugin-paginate-rest:\\@octokit\\/plugin-paginate-rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate-rest:\\@octokit\\/plugin_paginate_rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate_rest:\\@octokit\\/plugin-paginate-rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate_rest:\\@octokit\\/plugin_paginate_rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate:\\@octokit\\/plugin-paginate-rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin-paginate:\\@octokit\\/plugin_paginate_rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate:\\@octokit\\/plugin-paginate-rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin_paginate:\\@octokit\\/plugin_paginate_rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin:\\@octokit\\/plugin-paginate-rest:2.21.3:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/plugin:\\@octokit\\/plugin_paginate_rest:2.21.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40octokit/plugin-paginate-rest@2.21.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-xx4v-prfh-6cgc","dataSource":"https://github.com/advisories/GHSA-xx4v-prfh-6cgc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc","https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e","https://nvd.nist.gov/vuln/detail/CVE-2025-25289","https://github.com/octokit/request-error.js/blob/main/src/index.ts"],"description":"@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25289","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25289","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.1.1"],"state":"fixed","available":[{"version":"5.1.1","date":"2025-02-15","kind":"first-observed"}]},"advisories":[],"risk":0.32342},"relatedVulnerabilities":[{"id":"CVE-2025-25289","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25289","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/octokit/request-error.js/blob/main/src/index.ts","https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e","https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc"],"description":"@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and \"@\", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25289","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25289","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@octokit/request-error","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-xx4v-prfh-6cgc","versionConstraint":">=1.0.0,<5.1.1 (semantic)"},"fix":{"suggestedVersion":"5.1.1"}}],"artifact":{"id":"pkg:npm/%40octokit/request-error@1.2.1?package-id=606ee3bf261c3d6e","name":"@octokit/request-error","version":"1.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@octokit\\/request-error:\\@octokit\\/request-error:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request-error:\\@octokit\\/request_error:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request_error:\\@octokit\\/request-error:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request_error:\\@octokit\\/request_error:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request:\\@octokit\\/request-error:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request:\\@octokit\\/request_error:1.2.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40octokit/request-error@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xx4v-prfh-6cgc","dataSource":"https://github.com/advisories/GHSA-xx4v-prfh-6cgc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc","https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e","https://nvd.nist.gov/vuln/detail/CVE-2025-25289","https://github.com/octokit/request-error.js/blob/main/src/index.ts"],"description":"@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25289","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25289","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.1.1"],"state":"fixed","available":[{"version":"5.1.1","date":"2025-02-15","kind":"first-observed"}]},"advisories":[],"risk":0.32342},"relatedVulnerabilities":[{"id":"CVE-2025-25289","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25289","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/octokit/request-error.js/blob/main/src/index.ts","https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e","https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc"],"description":"@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and \"@\", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-25289","epss":0.00628,"percentile":0.5009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-25289","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@octokit/request-error","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-xx4v-prfh-6cgc","versionConstraint":">=1.0.0,<5.1.1 (semantic)"},"fix":{"suggestedVersion":"5.1.1"}}],"artifact":{"id":"pkg:npm/%40octokit/request-error@2.1.0?package-id=f3146c875bfcf83d","name":"@octokit/request-error","version":"2.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@octokit\\/request-error:\\@octokit\\/request-error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request-error:\\@octokit\\/request_error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request_error:\\@octokit\\/request-error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request_error:\\@octokit\\/request_error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request:\\@octokit\\/request-error:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:\\@octokit\\/request:\\@octokit\\/request_error:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40octokit/request-error@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/helpers","version":"7.20.13"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/helpers@7.20.13?package-id=afa28a6106e02344","name":"@babel/helpers","version":"7.20.13","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/helpers:\\@babel\\/helpers:7.20.13:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/helpers@7.20.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/helpers","version":"7.24.0"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/helpers@7.24.0?package-id=e50de1ba8837fd0c","name":"@babel/helpers","version":"7.24.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@babel\\/helpers:\\@babel\\/helpers:7.24.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/helpers@7.24.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2c7-rcm5-vvqj","dataSource":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj","https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://nvd.nist.gov/vuln/detail/CVE-2026-33671"],"description":"Picomatch has a ReDoS vulnerability via extglob quantifiers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.315},"relatedVulnerabilities":[{"id":"CVE-2026-33671","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33671","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-c2c7-rcm5-vvqj","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.3.1?package-id=c6f9f9e04b30bb9d","name":"picomatch","version":"2.3.1","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mwcw-c2x4-8c55","dataSource":"https://github.com/advisories/GHSA-mwcw-c2x4-8c55","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55565","https://github.com/ai/nanoid/pull/510","https://github.com/ai/nanoid/compare/3.3.7...3.3.8","https://github.com/ai/nanoid/releases/tag/5.0.9","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html"],"description":"Predictable results in nanoid generation when given non-integer values","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-55565","epss":0.00665,"percentile":0.51791,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-55565","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.3.8"],"state":"fixed","available":[{"version":"3.3.8","date":"2024-12-10","kind":"first-observed"}]},"advisories":[],"risk":0.30922499999999997},"relatedVulnerabilities":[{"id":"CVE-2024-55565","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55565","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ai/nanoid/compare/3.3.7...3.3.8","https://github.com/ai/nanoid/pull/510","https://github.com/ai/nanoid/releases/tag/5.0.9","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html"],"description":"nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-55565","epss":0.00665,"percentile":0.51791,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-55565","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.1.25"}},"found":{"vulnerabilityID":"GHSA-mwcw-c2x4-8c55","versionConstraint":"<3.3.8 (semantic)"},"fix":{"suggestedVersion":"3.3.8"}}],"artifact":{"id":"pkg:npm/nanoid@3.1.25?package-id=1e191a15440e5c37","name":"nanoid","version":"3.1.25","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.1.25:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.1.25","upstreams":[]}},{"vulnerability":{"id":"GHSA-rfgv-xxqx-mfg5","dataSource":"https://github.com/advisories/GHSA-rfgv-xxqx-mfg5","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","https://nvd.nist.gov/vuln/detail/CVE-2026-19534","https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5","https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728","https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19534","epss":0.00394,"percentile":0.33604,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-19534","cwe":"CWE-252","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.29550000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-19534","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"],"description":"undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeError. Because that code runs inside a microtask with no surrounding error handling, the exception propagates and terminates the process under Node's default behavior, instead of gracefully failing the connection as required by the WebSocket protocol. Any application that opens a WebSocket to an attacker-controlled or compromised server, or over a plaintext connection subject to a machine-in-the-middle, can be crashed remotely without authentication in the default configuration. This affects undici versions from 6.7.0 up to 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19534","epss":0.00394,"percentile":0.33604,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19534","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-19534","cwe":"CWE-252","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-rfgv-xxqx-mfg5","versionConstraint":">=7.0.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-01-17","kind":"first-observed"}]},"advisories":[],"risk":0.29516},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23745","https://bugzilla.redhat.com/show_bug.cgi?id=2430538","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vcc3-ghjq-m6fr","dataSource":"https://github.com/advisories/GHSA-vcc3-ghjq-m6fr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-vcc3-ghjq-m6fr","https://nvd.nist.gov/vuln/detail/CVE-2026-45822","https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005","https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0","https://www.npmjs.com/package/decode-uri-component"],"description":"decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45822","epss":0.00507,"percentile":0.43265,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45822","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45822","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["0.5.0"],"state":"fixed","available":[{"version":"0.5.0","date":"2026-09-01","kind":"first-observed"}]},"advisories":[],"risk":0.29406},"relatedVulnerabilities":[{"id":"CVE-2026-45822","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45822","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js","https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005","https://www.npmjs.com/package/decode-uri-component"],"description":"decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45822","epss":0.00507,"percentile":0.43265,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45822","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45822","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-vcc3-ghjq-m6fr","versionConstraint":"<=0.4.2 (semantic)"},"fix":{"suggestedVersion":"0.5.0"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=76f950c9d6d1be13","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.9"],"state":"fixed","available":[{"version":"1.20.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.19.0"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":"<1.20.9 (semantic)"},"fix":{"suggestedVersion":"1.20.9"}}],"artifact":{"id":"pkg:npm/body-parser@1.19.0?package-id=51081b814cb442c4","name":"body-parser","version":"1.19.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:1.19.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.19.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.14.0"],"state":"fixed","available":[{"version":"6.14.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"6.12.6"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":"<6.14.0 (semantic)"},"fix":{"suggestedVersion":"6.14.0"}}],"artifact":{"id":"pkg:npm/ajv@6.12.6?package-id=de0e849a459a2ac3","name":"ajv","version":"6.12.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ajv:ajv:6.12.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@6.12.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-7p8r-x3mc-p8w7","dataSource":"https://github.com/advisories/GHSA-7p8r-x3mc-p8w7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7","https://nvd.nist.gov/vuln/detail/CVE-2026-18446","https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v4.1.2"],"description":"fast-uri vulnerable to host confusion via backslash authority introducer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18446","epss":0.0038,"percentile":0.32009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18446","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.5"],"state":"fixed","available":[{"version":"3.1.5","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.28500000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-18446","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18446","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7"],"description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18446","epss":0.0038,"percentile":0.32009,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18446","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-7p8r-x3mc-p8w7","versionConstraint":">=3.0.0,<3.1.5 (semantic)"},"fix":{"suggestedVersion":"3.1.5"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-395f-4hp3-45gv","dataSource":"https://github.com/advisories/GHSA-395f-4hp3-45gv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv","https://nvd.nist.gov/vuln/detail/CVE-2026-13311","https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec","https://github.com/ljharb/shell-quote/releases/tag/v1.9.0","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13311","epss":0.0036,"percentile":0.29834,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13311","cwe":"CWE-407","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["1.9.0"],"state":"fixed","available":[{"version":"1.9.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.2808},"relatedVulnerabilities":[{"id":"CVE-2026-13311","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13311","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv","https://www.npmjs.com/package/shell-quote"],"description":"shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13311","epss":0.0036,"percentile":0.29834,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13311","cwe":"CWE-407","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"shell-quote","version":"1.7.2"}},"found":{"vulnerabilityID":"GHSA-395f-4hp3-45gv","versionConstraint":"<=1.8.4 (semantic)"},"fix":{"suggestedVersion":"1.9.0"}}],"artifact":{"id":"pkg:npm/shell-quote@1.7.2?package-id=c41ad5d968719cf3","name":"shell-quote","version":"1.7.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:shell-quote_project:shell-quote:1.7.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/shell-quote@1.7.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-mgcc-cww5-fp2q","dataSource":"https://github.com/advisories/GHSA-mgcc-cww5-fp2q","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116587","https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6"],"description":"Go JOSE: DoS when parsing JWKs that contain RSA keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.6"],"state":"fixed","available":[{"version":"4.1.6","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.2745},"relatedVulnerabilities":[{"id":"CVE-2026-116587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116587","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6","https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-mgcc-cww5-fp2q","versionConstraint":"<=4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.6"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=e92e68a1db1159f9","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/cliv2/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-mgcc-cww5-fp2q","dataSource":"https://github.com/advisories/GHSA-mgcc-cww5-fp2q","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116587","https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6"],"description":"Go JOSE: DoS when parsing JWKs that contain RSA keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.6"],"state":"fixed","available":[{"version":"4.1.6","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.2745},"relatedVulnerabilities":[{"id":"CVE-2026-116587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116587","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6","https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-mgcc-cww5-fp2q","versionConstraint":"<=4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.6"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=5018644c4a0d0f63","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-qj8w-gfj5-8c6v","dataSource":"https://github.com/advisories/GHSA-qj8w-gfj5-8c6v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v","https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","https://nvd.nist.gov/vuln/detail/CVE-2026-34043","https://github.com/yahoo/serialize-javascript/releases/tag/v5.0.0"],"description":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34043","epss":0.00491,"percentile":0.42208,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34043","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34043","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.0.5"],"state":"fixed","available":[{"version":"7.0.5","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.267595},"relatedVulnerabilities":[{"id":"CVE-2026-34043","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34043","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v"],"description":"Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34043","epss":0.00491,"percentile":0.42208,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34043","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34043","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.0"}},"found":{"vulnerabilityID":"GHSA-qj8w-gfj5-8c6v","versionConstraint":">=5.0.0,<7.0.5 (semantic)"},"fix":{"suggestedVersion":"7.0.5"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.0?package-id=64612a3ac0f67076","name":"serialize-javascript","version":"6.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.0:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pmjh-fq2x-6v4x","dataSource":"https://github.com/advisories/GHSA-pmjh-fq2x-6v4x","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x","https://nvd.nist.gov/vuln/detail/CVE-2026-18149","https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74","https://github.com/nodejs/undici/commit/e905b5b87e6953bcc542af90557b2fee5b7b5974","https://hackerone.com/reports/3892751","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via orphaned RetryHandler response body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18149","epss":0.00481,"percentile":0.41502,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18149","cwe":"CWE-772","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.262145},"relatedVulnerabilities":[{"id":"CVE-2026-18149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18149","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x"],"description":"undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled server can trigger this with two short responses without keeping a connection open, and repeated requests accumulate pending promises and streams that can exhaust application concurrency or memory. This affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18149","epss":0.00481,"percentile":0.41502,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18149","cwe":"CWE-772","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-pmjh-fq2x-6v4x","versionConstraint":">=7.11.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w4pp-8pjf-rmxw","dataSource":"https://github.com/advisories/GHSA-w4pp-8pjf-rmxw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-9496","https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025","https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084","https://github.com/npm/pacote/commit/627a7dc1a214d857472a13b48e42559c75288c9e","https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508","https://github.com/npm/pacote/releases/tag/v21.5.1","https://github.com/npm/pacote/releases/tag/v22.0.0"],"description":"pacote is vulnerable to Denial of Service (DoS) via the addGitSha function","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9496","epss":0.00346,"percentile":0.28189,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9496","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2026-9496","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["21.5.1"],"state":"fixed","available":[{"version":"21.5.1","date":"2026-08-27","kind":"first-observed"}]},"advisories":[],"risk":0.26123},"relatedVulnerabilities":[{"id":"CVE-2026-9496","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9496","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2","https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025","https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084"],"description":"Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic,  causing excessive CPU consumption and potentially stalling or crashing the process.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9496","epss":0.00346,"percentile":0.28189,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-9496","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2026-9496","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"pacote","version":"17.0.7"}},"found":{"vulnerabilityID":"GHSA-w4pp-8pjf-rmxw","versionConstraint":">=11.2.7,<21.5.1 (semantic)"},"fix":{"suggestedVersion":"21.5.1"}}],"artifact":{"id":"pkg:npm/pacote@17.0.7?package-id=aca9d6a0a1f685af","name":"pacote","version":"17.0.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:pacote:pacote:17.0.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/pacote@17.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-xjj6-f33q-929c","dataSource":"https://github.com/advisories/GHSA-xjj6-f33q-929c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","https://nvd.nist.gov/vuln/detail/CVE-2026-109869","https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429","https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436","https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109869","epss":0.00344,"percentile":0.27941,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109869","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.258},"relatedVulnerabilities":[{"id":"CVE-2026-109869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"],"description":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109869","epss":0.00344,"percentile":0.27941,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109869","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109869","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-xjj6-f33q-929c","versionConstraint":">=7.18.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2e059e5e7365de9a","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.23"],"state":"fixed","available":[{"version":"8.5.23","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.254815},"relatedVulnerabilities":[{"id":"CVE-2026-69153","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.3.6"}},"found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"fix":{"suggestedVersion":"8.5.23"}}],"artifact":{"id":"pkg:npm/postcss@8.3.6?package-id=d60537998490ed6d","name":"postcss","version":"8.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2e059e5e7365de9a","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-qr28-fpjm-wq7f","dataSource":"https://github.com/advisories/GHSA-qr28-fpjm-wq7f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f","https://nvd.nist.gov/vuln/detail/CVE-2026-118664","https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1"],"description":"decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118664","epss":0.00318,"percentile":0.24817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118664","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118664","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.5.1"],"state":"fixed","available":[{"version":"0.5.1","date":"2026-10-30","kind":"first-observed"}]},"advisories":[],"risk":0.24963},"relatedVulnerabilities":[{"id":"CVE-2026-118664","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118664","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1","https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f"],"description":"decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118664","epss":0.00318,"percentile":0.24817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118664","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118664","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-qr28-fpjm-wq7f","versionConstraint":"<=0.5.0 (semantic)"},"fix":{"suggestedVersion":"0.5.1"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=76f950c9d6d1be13","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-v2v4-37r5-5v8g","dataSource":"https://github.com/advisories/GHSA-v2v4-37r5-5v8g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","https://nvd.nist.gov/vuln/detail/CVE-2026-42338"],"description":"ip-address has XSS in Address6 HTML-emitting methods","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42338","epss":0.00471,"percentile":0.4074,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["10.1.1"],"state":"fixed","available":[{"version":"10.1.1","date":"2026-05-06","kind":"first-observed"}]},"advisories":[],"risk":0.242565},"relatedVulnerabilities":[{"id":"CVE-2026-42338","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:35841","https://access.redhat.com/errata/RHSA-2026:35842","https://access.redhat.com/errata/RHSA-2026:35891","https://access.redhat.com/errata/RHSA-2026:35892","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:39246","https://access.redhat.com/errata/RHSA-2026:39868","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41947","https://access.redhat.com/errata/RHSA-2026:44237","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:51200","https://access.redhat.com/errata/RHSA-2026:52399","https://access.redhat.com/errata/RHSA-2026:56928","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62335","https://access.redhat.com/errata/RHSA-2026:62336","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-42338","https://bugzilla.redhat.com/show_bug.cgi?id=2476810","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.json"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42338","epss":0.00471,"percentile":0.4074,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42338","cwe":"CWE-79","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-v2v4-37r5-5v8g","versionConstraint":"<=10.1.0 (semantic)"},"fix":{"suggestedVersion":"10.1.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=3482994ca41f788f","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v37-7h3g-55p8","dataSource":"https://github.com/advisories/GHSA-2v37-7h3g-55p8","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67213","https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom","https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b","https://github.com/ai/nanoid/releases/tag/3.3.17","https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0","https://github.com/ai/nanoid/releases/tag/3.3.18"],"description":"nanoid: custom generators can loop indefinitely when size is zero","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.18"],"state":"fixed","available":[{"version":"3.3.18","date":"2026-08-13","kind":"first-observed"}]},"advisories":[],"risk":0.24080250000000003},"relatedVulnerabilities":[{"id":"CVE-2026-67213","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67213","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom"],"description":"nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67213","epss":0.00331,"percentile":0.26286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67213","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.1.25"}},"found":{"vulnerabilityID":"GHSA-2v37-7h3g-55p8","versionConstraint":"<3.3.18 (semantic)"},"fix":{"suggestedVersion":"3.3.18"}}],"artifact":{"id":"pkg:npm/nanoid@3.1.25?package-id=1e191a15440e5c37","name":"nanoid","version":"3.1.25","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.1.25:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.1.25","upstreams":[]}},{"vulnerability":{"id":"GHSA-28wg-ghj8-5hjv","dataSource":"https://github.com/advisories/GHSA-28wg-ghj8-5hjv","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-67214","https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","https://github.com/ai/nanoid/pull/600","https://github.com/ai/nanoid/pull/601","https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d"],"description":"nanoid: non-secure generators can loop indefinitely with negative size","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["3.3.16"],"state":"fixed","available":[{"version":"3.3.16","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.240075},"relatedVulnerabilities":[{"id":"CVE-2026-67214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/releases/tag/3.3.16","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"],"description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67214","epss":0.0033,"percentile":0.26154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-67214","cwe":"CWE-835","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.1.25"}},"found":{"vulnerabilityID":"GHSA-28wg-ghj8-5hjv","versionConstraint":"<3.3.16 (semantic)"},"fix":{"suggestedVersion":"3.3.16"}}],"artifact":{"id":"pkg:npm/nanoid@3.1.25?package-id=1e191a15440e5c37","name":"nanoid","version":"3.1.25","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.1.25:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.1.25","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.23944000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqcg-44mw-7w3h","dataSource":"https://github.com/advisories/GHSA-jqcg-44mw-7w3h","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"description":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.8"],"state":"fixed","available":[{"version":"2.0.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.2353},"relatedVulnerabilities":[{"id":"CVE-2026-90711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"],"description":"proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"proxy-addr","version":"2.0.7"}},"found":{"vulnerabilityID":"GHSA-jqcg-44mw-7w3h","versionConstraint":">=1.1.0,<2.0.8 (semantic)"},"fix":{"suggestedVersion":"2.0.8"}}],"artifact":{"id":"pkg:npm/proxy-addr@2.0.7?package-id=8ca1c1bb3809292e","name":"proxy-addr","version":"2.0.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:proxy-addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy-addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy_addr:2.0.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/proxy-addr@2.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-xjpj-3mr7-gcpf","dataSource":"https://github.com/advisories/GHSA-xjpj-3mr7-gcpf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33941"],"description":"Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33941","epss":0.00296,"percentile":0.22307,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33941","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.23235999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-33941","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33941","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33941","https://bugzilla.redhat.com/show_bug.cgi?id=2452524","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. Version 4.7.9 fixes the issue. Some workarounds are available. First, validate all CLI inputs before invoking the precompiler. Reject filenames and option values  that contain characters with JavaScript string-escaping significance (`\"`, `'`, `;`, etc.). Second, use a fixed, trusted namespace string passed via a configuration file rather than  command-line arguments in automated pipelines. Third, run the precompiler in a sandboxed environment (container with no write access to sensitive  paths) to limit the impact of successful exploitation. Fourth, audit template filenames in any repository or package that is consumed by an automated  build pipeline.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33941","epss":0.00296,"percentile":0.22307,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33941","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-xjpj-3mr7-gcpf","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-qrpm-p2h7-hrv2","dataSource":"https://github.com/advisories/GHSA-qrpm-p2h7-hrv2","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23566","https://github.com/ai/nanoid/pull/328","https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575","https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444","https://snyk.io/vuln/SNYK-JS-NANOID-2332193","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550"],"description":"Exposure of Sensitive Information to an Unauthorized Actor in nanoid","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23566","epss":0.0044,"percentile":0.3826,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23566","cwe":"CWE-704","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.1.31"],"state":"fixed","available":[{"version":"3.1.31","date":"2022-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.23100000000000004},"relatedVulnerabilities":[{"id":"CVE-2021-23566","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23566","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444","https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575","https://github.com/ai/nanoid/pull/328","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550","https://snyk.io/vuln/SNYK-JS-NANOID-2332193","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html"],"description":"The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"exploitabilityScore":2.6,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23566","epss":0.0044,"percentile":0.3826,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23566","cwe":"CWE-704","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.1.25"}},"found":{"vulnerabilityID":"GHSA-qrpm-p2h7-hrv2","versionConstraint":">=3.0.0,<3.1.31 (semantic)"},"fix":{"suggestedVersion":"3.1.31"}}],"artifact":{"id":"pkg:npm/nanoid@3.1.25?package-id=1e191a15440e5c37","name":"nanoid","version":"3.1.25","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.1.25:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.1.25","upstreams":[]}},{"vulnerability":{"id":"GHSA-48c2-rrv3-qjmp","dataSource":"https://github.com/advisories/GHSA-48c2-rrv3-qjmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp","https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b","https://github.com/eemeli/yaml/releases/tag/v1.10.3","https://github.com/eemeli/yaml/releases/tag/v2.8.3","https://nvd.nist.gov/vuln/detail/CVE-2026-33532"],"description":"yaml is vulnerable to Stack Overflow via deeply nested YAML collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33532","epss":0.00488,"percentile":0.42057,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33532","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.3"],"state":"fixed","available":[{"version":"2.8.3","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.22691999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-33532","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33532","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b","https://github.com/eemeli/yaml/releases/tag/v1.10.3","https://github.com/eemeli/yaml/releases/tag/v2.8.3","https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp"],"description":"`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2–10 KB). The `RangeError` is not a `YAMLParseError`, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one `[` and one `]`). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's `Parser` (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: `YAML.parse()`, `YAML.parseDocument()`, and `YAML.parseAllDocuments()`. Versions 1.10.3 and 2.8.3 contain a patch.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33532","epss":0.00488,"percentile":0.42057,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33532","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yaml","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-48c2-rrv3-qjmp","versionConstraint":">=2.0.0,<2.8.3 (semantic)"},"fix":{"suggestedVersion":"2.8.3"}}],"artifact":{"id":"pkg:npm/yaml@2.4.2?package-id=fbbf37e661fe5faa","name":"yaml","version":"2.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:eemeli:yaml:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yaml@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-01-01","kind":"first-observed"}]},"advisories":[],"risk":0.22499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=c5032cc2b96d1098","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xpg-4rpp-hhhm","dataSource":"https://github.com/advisories/GHSA-3xpg-4rpp-hhhm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm","https://nvd.nist.gov/vuln/detail/CVE-2026-84890","https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11","https://github.com/nodejs/undici/commit/7aac7f12f757844763c8b8f1ab6e305e80d55838","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via unbounded decompression of compressed responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84890","epss":0.00412,"percentile":0.35501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84890","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22454000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-84890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84890","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm"],"description":"undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84890","epss":0.00412,"percentile":0.35501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84890","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-3xpg-4rpp-hhhm","versionConstraint":">=7.15.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3wwx-pv8p-q78v","dataSource":"https://github.com/advisories/GHSA-3wwx-pv8p-q78v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v","https://nvd.nist.gov/vuln/detail/CVE-2026-85024","https://github.com/nodejs/undici/commit/07c60d9c7099a910451244afe42861bbdbdd974c","https://github.com/nodejs/undici/commit/4411a238a98e8791da5fff10cc9e3578a7668ed6","https://github.com/nodejs/undici/commit/63cf698b611fecc6ee0a17b185b930051e4b982f","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85024","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.22454000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-85024","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85024","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v"],"description":"undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash. This affects undici versions from 6.25.0 up to 6.28.1, from 7.28.0 up to 7.29.1, and from 8.1.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85024","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85024","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-3wwx-pv8p-q78v","versionConstraint":">=7.28.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxg6-pf52-xh8x","dataSource":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c"],"description":"cookie accepts cookie name, path, and domain with out of bounds characters","cvss":[],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.0"],"state":"fixed","available":[{"version":"0.7.0","date":"2024-10-05","kind":"first-observed"}]},"advisories":[],"risk":0.2232},"relatedVulnerabilities":[{"id":"CVE-2024-47764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x"],"description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cookie","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-pxg6-pf52-xh8x","versionConstraint":"<0.7.0 (semantic)"},"fix":{"suggestedVersion":"0.7.0"}}],"artifact":{"id":"pkg:npm/cookie@0.4.0?package-id=eed813c6818e23d5","name":"cookie","version":"0.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:cookie:cookie:0.4.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/cookie@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxg6-pf52-xh8x","dataSource":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c"],"description":"cookie accepts cookie name, path, and domain with out of bounds characters","cvss":[],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.0"],"state":"fixed","available":[{"version":"0.7.0","date":"2024-10-05","kind":"first-observed"}]},"advisories":[],"risk":0.2232},"relatedVulnerabilities":[{"id":"CVE-2024-47764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x"],"description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cookie","version":"0.4.2"}},"found":{"vulnerabilityID":"GHSA-pxg6-pf52-xh8x","versionConstraint":"<0.7.0 (semantic)"},"fix":{"suggestedVersion":"0.7.0"}}],"artifact":{"id":"pkg:npm/cookie@0.4.2?package-id=485d3d3067d7cb00","name":"cookie","version":"0.4.2","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cookie:cookie:0.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/cookie@0.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwg4-73v4-xw9w","dataSource":"https://github.com/advisories/GHSA-xwg4-73v4-xw9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","https://nvd.nist.gov/vuln/detail/CVE-2026-73086","https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11"],"description":"nanoid: Integer Overflow or Wraparound","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.3.12"],"state":"fixed","available":[{"version":"3.3.12","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.22052},"relatedVulnerabilities":[{"id":"CVE-2026-73086","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","https://github.com/ai/nanoid/releases/tag/3.3.12","https://github.com/ai/nanoid/releases/tag/5.1.11","https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"],"description":"nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73086","epss":0.00296,"percentile":0.22343,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73086","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nanoid","version":"3.1.25"}},"found":{"vulnerabilityID":"GHSA-xwg4-73v4-xw9w","versionConstraint":"<3.3.12 (semantic)"},"fix":{"suggestedVersion":"3.3.12"}}],"artifact":{"id":"pkg:npm/nanoid@3.1.25?package-id=1e191a15440e5c37","name":"nanoid","version":"3.1.25","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nanoid_project:nanoid:3.1.25:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nanoid@3.1.25","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2e059e5e7365de9a","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-3v7f-55p6-f55p","dataSource":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p","https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://nvd.nist.gov/vuln/detail/CVE-2026-33672"],"description":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.21887500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33672","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33672","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-3v7f-55p6-f55p","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.3.1?package-id=c6f9f9e04b30bb9d","name":"picomatch","version":"2.3.1","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101913","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101913","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.1"],"state":"fixed","available":[{"version":"10.5.1","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.21809},"relatedVulnerabilities":[{"id":"CVE-2026-101913","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101913","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101913","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=3482994ca41f788f","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=a9efc5a07e1f6ee7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101911","epss":0.00383,"percentile":0.32363,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101911","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.7.1"],"state":"fixed","available":[{"version":"10.7.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.216395},"relatedVulnerabilities":[{"id":"CVE-2026-101911","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101911","epss":0.00383,"percentile":0.32363,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101911","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"fix":{"suggestedVersion":"10.7.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=3482994ca41f788f","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.21516000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23950","https://bugzilla.redhat.com/show_bug.cgi?id=2431036","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23950.json"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=c5032cc2b96d1098","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-06-29","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":"<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=a9efc5a07e1f6ee7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/pull/346","https://github.com/postcss/postcss-selector-parser/commit/70b0779c843462197380d25daa02d1528bf7eae5","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5"],"description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.1.5"],"state":"fixed","available":[{"version":"6.1.5","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0.212005},"relatedVulnerabilities":[{"id":"CVE-2026-104844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"6.0.6"}},"found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<6.1.5 (semantic)"},"fix":{"suggestedVersion":"6.1.5"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@6.0.6?package-id=694206a775877344","name":"postcss-selector-parser","version":"6.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:6.0.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@6.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-9ppj-qmqm-q256","dataSource":"https://github.com/advisories/GHSA-9ppj-qmqm-q256","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256","https://nvd.nist.gov/vuln/detail/CVE-2026-31802","https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"],"description":"node-tar Symlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.21116500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-31802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31802","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad","https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-9ppj-qmqm-q256","versionConstraint":"<=7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-cm22-4g7w-348p","dataSource":"https://github.com/advisories/GHSA-cm22-4g7w-348p","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p","https://nvd.nist.gov/vuln/detail/CVE-2024-43800","https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b","https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa"],"description":"serve-static vulnerable to template injection that can lead to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43800","epss":0.00631,"percentile":0.50257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43800","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.2098075},"relatedVulnerabilities":[{"id":"CVE-2024-43800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43800","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b","https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa","https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p"],"description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43800","epss":0.00631,"percentile":0.50257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43800","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serve-static","version":"1.14.1"}},"found":{"vulnerabilityID":"GHSA-cm22-4g7w-348p","versionConstraint":"<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/serve-static@1.14.1?package-id=6220af9c642a9422","name":"serve-static","version":"1.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:serve-static:serve-static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve-static:serve_static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve_static:serve-static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve_static:serve_static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve:serve-static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve:serve_static:1.14.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/serve-static@1.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101912","epss":0.0037,"percentile":0.30998,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101912","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.7.1"],"state":"fixed","available":[{"version":"10.7.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.20904999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-101912","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101912","epss":0.0037,"percentile":0.30998,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101912","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"fix":{"suggestedVersion":"10.7.1"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=3482994ca41f788f","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@8.3.2?package-id=8cf0c19ede45d1bc","name":"uuid","version":"8.3.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:uuidjs:uuid:8.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rx4f-c7p8-82vq","dataSource":"https://github.com/advisories/GHSA-rx4f-c7p8-82vq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq","https://nvd.nist.gov/vuln/detail/CVE-2026-85014","https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349","https://github.com/nodejs/undici/commit/662d0ea671fe64139e79533c913fce412765e1d7","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to Denial of Service via WebSocketStream unclean close","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85014","epss":0.00368,"percentile":0.3066,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85014","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-85014","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.20056000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-85014","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85014","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq"],"description":"undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85014","epss":0.00368,"percentile":0.3066,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85014","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-85014","cwe":"CWE-754","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-rx4f-c7p8-82vq","versionConstraint":">=7.0.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=c5032cc2b96d1098","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.4.1"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@10.4.1?package-id=d7d402979916b388","name":"glob","version":"10.4.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.4.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.4.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7236-3392-c5c6","dataSource":"https://github.com/advisories/GHSA-7236-3392-c5c6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6"],"description":"BuildKit: Custom frontend could bypass Seccomp/AppArmor","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61711","epss":0.00357,"percentile":0.29455,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61711","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-08-20","kind":"first-observed"}]},"advisories":[],"risk":0.183855},"relatedVulnerabilities":[{"id":"CVE-2026-61711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61711","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/buildkit/commit/3ea6dd0ce7d269cdb8aa23348718e2c1bf64f109","https://github.com/moby/buildkit/commit/64bbec89ca43dd95b2853edeca240c33c6729910","https://github.com/moby/buildkit/releases/tag/v0.31.1","https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6"],"description":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61711","epss":0.00357,"percentile":0.29455,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61711","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/buildkit","version":"v0.30.0"}},"found":{"vulnerabilityID":"GHSA-7236-3392-c5c6","versionConstraint":"<=0.31.0 (go)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:golang/github.com/moby/buildkit@v0.30.0?package-id=873370e02c0bf868","name":"github.com/moby/buildkit","version":"v0.30.0","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:buildkit:v0.30.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/buildkit@v0.30.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:OsK8T3BaYH52UNStpKd7gytDtHWWt2Fawak/lAPWatU="}}},{"vulnerability":{"id":"GHSA-gvwx-54wh-qm9j","dataSource":"https://github.com/advisories/GHSA-gvwx-54wh-qm9j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j","https://nvd.nist.gov/vuln/detail/CVE-2026-59875","https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17"],"description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.17"],"state":"fixed","available":[{"version":"7.5.17","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.18231000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-59875","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-gvwx-54wh-qm9j","versionConstraint":"<=7.5.16 (semantic)"},"fix":{"suggestedVersion":"7.5.17"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w7fw-mjwx-w883","dataSource":"https://github.com/advisories/GHSA-w7fw-mjwx-w883","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://nvd.nist.gov/vuln/detail/CVE-2026-2391","https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"],"description":"qs's arrayLimit bypass in comma parsing allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.2"],"state":"fixed","available":[{"version":"6.14.2","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.18157},"relatedVulnerabilities":[{"id":"CVE-2026-2391","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2391","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"],"description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {\n    return val.split(',');\n}\n\nif (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {\n    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');\n}\n\nreturn val;\n```\nThe `split(',')` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs = require('qs');\n\nconst payload = 'a=' + ','.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n  const result = qs.parse(payload, options);\n  console.log(result.a.length);  // Outputs: 26 (bypass successful)\n} catch (e) {\n  console.log('Limit enforced:', e.message);  // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-w7fw-mjwx-w883","versionConstraint":">=6.7.0,<=6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.2"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=c5032cc2b96d1098","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gcqx-w48m-w2h4","dataSource":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93753","https://github.com/TehShrike/deepmerge/issues/273","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge mergeObject() allows prototype poisoning of returned objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-93753","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/TehShrike/deepmerge","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://github.com/TehShrike/deepmerge/issues/273","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"deepmerge","version":"4.3.0"}},"found":{"vulnerabilityID":"GHSA-gcqx-w48m-w2h4","versionConstraint":">=4.2.0,<=4.3.1 (semantic)"}}],"artifact":{"id":"pkg:npm/deepmerge@4.3.0?package-id=8ba461fb3eb9525f","name":"deepmerge","version":"4.3.0","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:deepmerge:deepmerge:4.3.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/deepmerge@4.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gcqx-w48m-w2h4","dataSource":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93753","https://github.com/TehShrike/deepmerge/issues/273","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge mergeObject() allows prototype poisoning of returned objects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-93753","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/TehShrike/deepmerge","https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","https://github.com/TehShrike/deepmerge/issues/273","https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"],"description":"deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93753","epss":0.00514,"percentile":0.43823,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93753","cwe":"CWE-1321","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"deepmerge","version":"4.3.1"}},"found":{"vulnerabilityID":"GHSA-gcqx-w48m-w2h4","versionConstraint":">=4.2.0,<=4.3.1 (semantic)"}}],"artifact":{"id":"pkg:npm/deepmerge@4.3.1?package-id=1136b8a759ab5808","name":"deepmerge","version":"4.3.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:deepmerge:deepmerge:4.3.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/deepmerge@4.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-m6fv-jmcg-4jfg","dataSource":"https://github.com/advisories/GHSA-m6fv-jmcg-4jfg","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg","https://nvd.nist.gov/vuln/detail/CVE-2024-43799","https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35","https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html"],"description":"send vulnerable to template injection that can lead to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43799","epss":0.00541,"percentile":0.45548,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43799","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.19.0"],"state":"fixed","available":[{"version":"0.19.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.1798825},"relatedVulnerabilities":[{"id":"CVE-2024-43799","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43799","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35","https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg","https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html"],"description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43799","epss":0.00541,"percentile":0.45548,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43799","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"send","version":"0.17.1"}},"found":{"vulnerabilityID":"GHSA-m6fv-jmcg-4jfg","versionConstraint":"<0.19.0 (semantic)"},"fix":{"suggestedVersion":"0.19.0"}}],"artifact":{"id":"pkg:npm/send@0.17.1?package-id=ad22f4f5098d39f1","name":"send","version":"0.17.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:send_project:send:0.17.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/send@0.17.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qw65-cvwx-89v3","dataSource":"https://github.com/advisories/GHSA-qw65-cvwx-89v3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","https://nvd.nist.gov/vuln/detail/CVE-2026-84292","https://github.com/fastify/fast-uri/commit/820e8478dd7da3d09f187bfaf35d50b71f67b8b4","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.6","https://github.com/fastify/fast-uri/releases/tag/v3.1.7","https://github.com/fastify/fast-uri/releases/tag/v4.1.4"],"description":"fast-uri vulnerable to authority injection via an unvalidated port in serialize","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.7"],"state":"fixed","available":[{"version":"3.1.7","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.17925000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-84292","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"],"description":"fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-qw65-cvwx-89v3","versionConstraint":">=3.0.0,<3.1.7 (semantic)"},"fix":{"suggestedVersion":"3.1.7"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":["10.7.4"],"state":"fixed","available":[{"version":"10.7.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.177975},"relatedVulnerabilities":[{"id":"CVE-2026-111997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"fix":{"suggestedVersion":"10.7.4"}}],"artifact":{"id":"pkg:npm/ip-address@9.0.5?package-id=3482994ca41f788f","name":"ip-address","version":"9.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:beaugunderson:ip-address:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.5.1"],"state":"fixed","available":[{"version":"3.5.1","date":"2026-01-31","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"3.5.0"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":"<3.5.1 (semantic)"},"fix":{"suggestedVersion":"3.5.1"}}],"artifact":{"id":"pkg:npm/diff@3.5.0?package-id=bcae58ed2cd09e9a","name":"diff","version":"3.5.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:kpdecker:jsdiff:3.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@3.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.0.4"],"state":"fixed","available":[{"version":"4.0.4","date":"2026-01-21","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"4.0.2"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=4.0.0,<4.0.4 (semantic)"},"fix":{"suggestedVersion":"4.0.4"}}],"artifact":{"id":"pkg:npm/diff@4.0.2?package-id=0455b47f48804929","name":"diff","version":"4.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:kpdecker:jsdiff:4.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@4.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["5.2.2"],"state":"fixed","available":[{"version":"5.2.2","date":"2026-01-21","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"5.2.0"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=5.0.0,<5.2.2 (semantic)"},"fix":{"suggestedVersion":"5.2.2"}}],"artifact":{"id":"pkg:npm/diff@5.2.0?package-id=c805b5dd6611874c","name":"diff","version":"5.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:kpdecker:jsdiff:5.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@5.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4qv8-2p9j-2685","dataSource":"https://github.com/advisories/GHSA-4qv8-2p9j-2685","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","https://nvd.nist.gov/vuln/detail/CVE-2026-109924","https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6","https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab","https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109924","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.17494500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109924","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"],"description":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109924","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109924","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-4qv8-2p9j-2685","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9fm3-97px-rjf6","dataSource":"https://github.com/advisories/GHSA-9fm3-97px-rjf6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6","https://nvd.nist.gov/vuln/detail/CVE-2026-109932","https://github.com/nodejs/undici/commit/39f93e142df03e559fe7c3d1fc7fba9beee2c185","https://github.com/nodejs/undici/commit/53944624462b6797560288c55dbd8c66857bb495","https://github.com/nodejs/undici/commit/b217373bb024cd93f85eb5b3ffd25684855f60f8","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109932","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109932","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-405","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.17494500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109932","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"],"description":"undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109932","epss":0.00321,"percentile":0.2513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109932","cwe":"CWE-400","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-405","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109932","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-9fm3-97px-rjf6","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2jfj-6hjv-fm6j","dataSource":"https://github.com/advisories/GHSA-2jfj-6hjv-fm6j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j","https://nvd.nist.gov/vuln/detail/CVE-2026-84933","https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988","https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84933","epss":0.00303,"percentile":0.23067,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84933","cwe":"CWE-200","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-84933","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.174225},"relatedVulnerabilities":[{"id":"CVE-2026-84933","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84933","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j"],"description":"undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84933","epss":0.00303,"percentile":0.23067,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84933","cwe":"CWE-200","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-84933","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-2jfj-6hjv-fm6j","versionConstraint":">=7.0.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqff-g426-hqxp","dataSource":"https://github.com/advisories/GHSA-jqff-g426-hqxp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","https://nvd.nist.gov/vuln/detail/CVE-2026-76172","https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862","https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b","https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76172","epss":0.00232,"percentile":0.14137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76172","cwe":"CWE-177","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.174},"relatedVulnerabilities":[{"id":"CVE-2026-76172","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"],"description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76172","epss":0.00232,"percentile":0.14137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-76172","cwe":"CWE-177","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-jqff-g426-hqxp","versionConstraint":">=3.0.0,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-vvm8-gf78-28g4","dataSource":"https://github.com/advisories/GHSA-vvm8-gf78-28g4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","https://nvd.nist.gov/vuln/detail/CVE-2026-116586","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panics in JSON parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-116586","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-vvm8-gf78-28g4","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=e92e68a1db1159f9","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/cliv2/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-vvm8-gf78-28g4","dataSource":"https://github.com/advisories/GHSA-vvm8-gf78-28g4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","https://nvd.nist.gov/vuln/detail/CVE-2026-116586","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panics in JSON parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-116586","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-vvm8-gf78-28g4","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=5018644c4a0d0f63","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.5?package-id=35a06022798aa111","name":"minimatch","version":"10.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BlueOak-1.0.0"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=9838fb0cc6ec7421","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.3"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.3?package-id=82a899b869f50d38","name":"minimatch","version":"3.1.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.4"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.4?package-id=224f6ad7dca47ee8","name":"minimatch","version":"9.0.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.9"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.9?package-id=a7d1861a4b2f1279","name":"minimatch","version":"9.0.9","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-x7hr-w5r2-h6wg","dataSource":"https://github.com/advisories/GHSA-x7hr-w5r2-h6wg","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-53382","https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660","https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259","https://github.com/PrismJS/prism/pull/3863","https://github.com/PrismJS/prism/commit/8e8b9352dac64457194dd9e51096b4772532e53d"],"description":"PrismJS DOM Clobbering vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.9,"exploitabilityScore":1.8,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-53382","epss":0.00342,"percentile":0.27701,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-53382","cwe":"CWE-94","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2024-53382","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.30.0"],"state":"fixed","available":[{"version":"1.30.0","date":"2025-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.16929},"relatedVulnerabilities":[{"id":"CVE-2024-53382","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-53382","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660","https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259"],"description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.9,"exploitabilityScore":1.8,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-53382","epss":0.00342,"percentile":0.27701,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-53382","cwe":"CWE-94","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2024-53382","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"prismjs","version":"1.29.0"}},"found":{"vulnerabilityID":"GHSA-x7hr-w5r2-h6wg","versionConstraint":"<1.30.0 (semantic)"},"fix":{"suggestedVersion":"1.30.0"}}],"artifact":{"id":"pkg:npm/prismjs@1.29.0?package-id=cc38b783633a2463","name":"prismjs","version":"1.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:prismjs:prism:1.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/prismjs@1.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f65p-4m7j-42xc","dataSource":"https://github.com/advisories/GHSA-f65p-4m7j-42xc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","https://nvd.nist.gov/vuln/detail/CVE-2026-75975","https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595","https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f","https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"description":"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75975","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75975","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75975","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.6"],"state":"fixed","available":[{"version":"3.1.6","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.165},"relatedVulnerabilities":[{"id":"CVE-2026-75975","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc"],"description":"fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-75975","epss":0.0022,"percentile":0.12579,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-75975","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-75975","cwe":"CWE-918","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-f65p-4m7j-42xc","versionConstraint":">=3.0.0,<3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.6"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-qw6h-vgh9-j6wx","dataSource":"https://github.com/advisories/GHSA-qw6h-vgh9-j6wx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx","https://nvd.nist.gov/vuln/detail/CVE-2024-43796","https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553"],"description":"express vulnerable to XSS via response.redirect()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43796","epss":0.00486,"percentile":0.41882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43796","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.20.0"],"state":"fixed","available":[{"version":"4.20.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.161595},"relatedVulnerabilities":[{"id":"CVE-2024-43796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43796","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553","https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx"],"description":"Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43796","epss":0.00486,"percentile":0.41882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43796","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express","version":"4.17.1"}},"found":{"vulnerabilityID":"GHSA-qw6h-vgh9-j6wx","versionConstraint":"<4.20.0 (semantic)"},"fix":{"suggestedVersion":"4.20.0"}}],"artifact":{"id":"pkg:npm/express@4.17.1?package-id=79d3c1dfb6449b7a","name":"express","version":"4.17.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:express:4.17.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express@4.17.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-869p-cjfg-cm3x","dataSource":"https://github.com/advisories/GHSA-869p-cjfg-cm3x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x","https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6","https://github.com/auth0/node-jws/releases/tag/v3.2.3","https://github.com/auth0/node-jws/releases/tag/v4.0.1","https://nvd.nist.gov/vuln/detail/CVE-2025-65945"],"description":"auth0/node-jws Improperly Verifies HMAC Signature","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-65945","epss":0.00215,"percentile":0.1199,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-65945","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.2.3"],"state":"fixed","available":[{"version":"3.2.3","date":"2025-12-05","kind":"first-observed"}]},"advisories":[],"risk":0.16125},"relatedVulnerabilities":[{"id":"CVE-2025-65945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-65945","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x"],"description":"auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-65945","epss":0.00215,"percentile":0.1199,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-65945","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jws","version":"3.2.2"}},"found":{"vulnerabilityID":"GHSA-869p-cjfg-cm3x","versionConstraint":"<3.2.3 (semantic)"},"fix":{"suggestedVersion":"3.2.3"}}],"artifact":{"id":"pkg:npm/jws@3.2.2?package-id=0146126285afeaa5","name":"jws","version":"3.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:jws:jws:3.2.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/jws@3.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4w3g-jfj2-cw2q","dataSource":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116585","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panic during CBC-HMAC processing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.15708},"relatedVulnerabilities":[{"id":"CVE-2026-116585","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-4w3g-jfj2-cw2q","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=e92e68a1db1159f9","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/cliv2/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-4w3g-jfj2-cw2q","dataSource":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116585","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panic during CBC-HMAC processing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.15708},"relatedVulnerabilities":[{"id":"CVE-2026-116585","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-4w3g-jfj2-cw2q","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=5018644c4a0d0f63","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["1.1.12"],"state":"fixed","available":[{"version":"1.1.12","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=1.0.0,<=1.1.11 (semantic)"},"fix":{"suggestedVersion":"1.1.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2e059e5e7365de9a","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-55wc-3pg8-jfw6","dataSource":"https://github.com/advisories/GHSA-55wc-3pg8-jfw6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6","https://nvd.nist.gov/vuln/detail/CVE-2026-87029","https://github.com/nodejs/undici/commit/63cba7712ca012b2603c6aeeb4c72d8692332cd0","https://github.com/nodejs/undici/commit/f851f315db1f2acce0ea668f88d9d0fa61c8420c","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87029","epss":0.0026,"percentile":0.17806,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87029","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.14170000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-87029","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87029","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6"],"description":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87029","epss":0.0026,"percentile":0.17806,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87029","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-55wc-3pg8-jfw6","versionConstraint":">=7.15.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xw65-4hp5-5hc7","dataSource":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","https://nvd.nist.gov/vuln/detail/CVE-2026-106444","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106444","epss":0.0029,"percentile":0.21631,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.14064999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-106444","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106444","epss":0.0029,"percentile":0.21631,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-xw65-4hp5-5hc7","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-qrxm-fqhp-jwvm","dataSource":"https://github.com/advisories/GHSA-qrxm-fqhp-jwvm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm","https://nvd.nist.gov/vuln/detail/CVE-2026-87018","https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309","https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28","https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87018","epss":0.00187,"percentile":0.08364,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87018","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87018","cwe":"CWE-617","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.14024999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-87018","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"],"description":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87018","epss":0.00187,"percentile":0.08364,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87018","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87018","cwe":"CWE-617","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-qrxm-fqhp-jwvm","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-110306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-v422-hmwv-36x6","dataSource":"https://github.com/advisories/GHSA-v422-hmwv-36x6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6","https://nvd.nist.gov/vuln/detail/CVE-2026-12590","https://github.com/expressjs/body-parser/pull/698","https://github.com/expressjs/body-parser/pull/741","https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d","https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.6","https://github.com/expressjs/body-parser/releases/tag/v2.3.0"],"description":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.6"],"state":"fixed","available":[{"version":"1.20.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.13802},"relatedVulnerabilities":[{"id":"CVE-2026-12590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"],"description":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.19.0"}},"found":{"vulnerabilityID":"GHSA-v422-hmwv-36x6","versionConstraint":"<1.20.6 (semantic)"},"fix":{"suggestedVersion":"1.20.6"}}],"artifact":{"id":"pkg:npm/body-parser@1.19.0?package-id=51081b814cb442c4","name":"body-parser","version":"1.19.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:openjsf:body-parser:1.19.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.19.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f72v-6w45-q472","dataSource":"https://github.com/advisories/GHSA-f72v-6w45-q472","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472","https://nvd.nist.gov/vuln/detail/CVE-2026-109841","https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00","https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109841","epss":0.00252,"percentile":0.16692,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13734000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-109841","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"],"description":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109841","epss":0.00252,"percentile":0.16692,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109841","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-f72v-6w45-q472","versionConstraint":">=7.15.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2m5v-pch6-74hx","dataSource":"https://github.com/advisories/GHSA-2m5v-pch6-74hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx","https://nvd.nist.gov/vuln/detail/CVE-2026-109383","https://github.com/nodejs/undici/commit/04cb74b1db131ff8f5b4557dce811cbf5f4664b4","https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f","https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.29.1","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109383","epss":0.00184,"percentile":0.08023,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109383","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.13707999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-109383","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"],"description":"undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109383","epss":0.00184,"percentile":0.08023,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109383","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-2m5v-pch6-74hx","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2qvq-rjwj-gvw9","dataSource":"https://github.com/advisories/GHSA-2qvq-rjwj-gvw9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9","https://nvd.nist.gov/vuln/detail/CVE-2021-23369","https://nvd.nist.gov/vuln/detail/CVE-2021-23383","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33916"],"description":"Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33916","epss":0.0028,"percentile":0.20536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33916","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33916","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.1358},"relatedVulnerabilities":[{"id":"CVE-2026-33916","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33916","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype  pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates  and reduces the attack surface.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33916","epss":0.0028,"percentile":0.20536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33916","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33916","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-2qvq-rjwj-gvw9","versionConstraint":">=4.0.0,<4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-w293-vg96-wgc3","dataSource":"https://github.com/advisories/GHSA-w293-vg96-wgc3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3","https://nvd.nist.gov/vuln/detail/CVE-2026-84961","https://github.com/nodejs/undici/commit/8f5868fbdbc8f1146dfc1bcd1f2d117790141390","https://github.com/nodejs/undici/commit/f690157d728508652fef14673630c71515123e96","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84961","epss":0.00178,"percentile":0.0739,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84961","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.13261},"relatedVulnerabilities":[{"id":"CVE-2026-84961","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84961","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3"],"description":"undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84961","epss":0.00178,"percentile":0.0739,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84961","cwe":"CWE-295","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-w293-vg96-wgc3","versionConstraint":">=7.24.1,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-52v5-jr5w-gjxr","dataSource":"https://github.com/advisories/GHSA-52v5-jr5w-gjxr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"],"description":"sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48815","epss":0.00173,"percentile":0.06772,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48815","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0.12975},"relatedVulnerabilities":[{"id":"CVE-2026-48815","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48815","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b","https://github.com/sigstore/sigstore-js/pull/1658","https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1","https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"],"description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48815","epss":0.00173,"percentile":0.06772,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48815","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sigstore","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-52v5-jr5w-gjxr","versionConstraint":"<=4.1.0 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"pkg:npm/sigstore@2.3.1?package-id=6c35e75960bff322","name":"sigstore","version":"2.3.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:sigstore:sigstore:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sigstore@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-685w-q87j-wqw3","dataSource":"https://github.com/advisories/GHSA-685w-q87j-wqw3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3","https://nvd.nist.gov/vuln/detail/CVE-2026-85747","https://github.com/distribution/distribution/commit/8f91c26c8888a95a36c2357a6e30bc15d4dd76d3","https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2"],"description":"Distribution: Client `manifests.Get()` does not verify returned content against requested digest","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.12861999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-85747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85747","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2","https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3"],"description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/distribution","version":"v2.8.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-685w-q87j-wqw3","versionConstraint":"<=2.8.3 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/distribution@v2.8.2%2Bincompatible?package-id=642343fdb33bff47","name":"github.com/docker/distribution","version":"v2.8.2+incompatible","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:distribution:v2.8.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/distribution@v2.8.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8="}}},{"vulnerability":{"id":"GHSA-685w-q87j-wqw3","dataSource":"https://github.com/advisories/GHSA-685w-q87j-wqw3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3","https://nvd.nist.gov/vuln/detail/CVE-2026-85747","https://github.com/distribution/distribution/commit/8f91c26c8888a95a36c2357a6e30bc15d4dd76d3","https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2"],"description":"Distribution: Client `manifests.Get()` does not verify returned content against requested digest","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.12861999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-85747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85747","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2","https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3"],"description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/distribution","version":"v2.8.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-685w-q87j-wqw3","versionConstraint":"<=2.8.3 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/distribution@v2.8.2%2Bincompatible?package-id=41f4cd3dfb0c4021","name":"github.com/docker/distribution","version":"v2.8.2+incompatible","type":"go-module","locations":[{"path":"/cliv2/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:distribution:v2.8.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/distribution@v2.8.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8="}}},{"vulnerability":{"id":"GHSA-jfc7-64v2-mr8c","dataSource":"https://github.com/advisories/GHSA-jfc7-64v2-mr8c","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c"],"description":"@sigstore/core has DSSE payloadType type-binding failure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48758","epss":0.00239,"percentile":0.14974,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48758","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.2.1"],"state":"fixed","available":[{"version":"3.2.1","date":"2026-06-27","kind":"first-observed"}]},"advisories":[],"risk":0.12428},"relatedVulnerabilities":[{"id":"CVE-2026-48758","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48758","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7","https://github.com/sigstore/sigstore-js/pull/1657","https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1","https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c"],"description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48758","epss":0.00239,"percentile":0.14974,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48758","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@sigstore/core","version":"1.1.0"}},"found":{"vulnerabilityID":"GHSA-jfc7-64v2-mr8c","versionConstraint":"<=3.2.0 (semantic)"},"fix":{"suggestedVersion":"3.2.1"}}],"artifact":{"id":"pkg:npm/%40sigstore/core@1.1.0?package-id=e83ab1396030b7db","name":"@sigstore/core","version":"1.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:\\@sigstore\\/core:\\@sigstore\\/core:1.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40sigstore/core@1.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrr3-gc8f-f4qj","dataSource":"https://github.com/advisories/GHSA-hrr3-gc8f-f4qj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472","https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.7","https://github.com/fastify/fast-uri/releases/tag/v3.1.8","https://github.com/fastify/fast-uri/releases/tag/v4.1.5"],"description":"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.8"],"state":"fixed","available":[{"version":"3.1.8","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.12397000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-86472","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj"],"description":"fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-hrr3-gc8f-f4qj","versionConstraint":">=3.0.0,<3.1.8 (semantic)"},"fix":{"suggestedVersion":"3.1.8"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-qx2v-qp2m-jg93","dataSource":"https://github.com/advisories/GHSA-qx2v-qp2m-jg93","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93","https://nvd.nist.gov/vuln/detail/CVE-2026-41305","https://github.com/postcss/postcss/releases/tag/8.5.10"],"description":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.10"],"state":"fixed","available":[{"version":"8.5.10","date":"2026-04-24","kind":"first-observed"}]},"advisories":[],"risk":0.11377499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41305","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/releases/tag/8.5.10","https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"8.3.6"}},"found":{"vulnerabilityID":"GHSA-qx2v-qp2m-jg93","versionConstraint":"<8.5.10 (semantic)"},"fix":{"suggestedVersion":"8.5.10"}}],"artifact":{"id":"pkg:npm/postcss@8.3.6?package-id=d60537998490ed6d","name":"postcss","version":"8.3.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:postcss:postcss:8.3.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@8.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-4w7w-5xrc-9h26","dataSource":"https://github.com/advisories/GHSA-4w7w-5xrc-9h26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26","https://nvd.nist.gov/vuln/detail/CVE-2026-109829","https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8","https://github.com/nodejs/undici/commit/b20b82ad80a405a12b6ce1f341bcd418de390aa0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"description":"undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109829","epss":0.00149,"percentile":0.0406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109829","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109829","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.30.1"],"state":"fixed","available":[{"version":"7.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.111005},"relatedVulnerabilities":[{"id":"CVE-2026-109829","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"],"description":"undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-109829","epss":0.00149,"percentile":0.0406,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-109829","cwe":"CWE-346","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-109829","cwe":"CWE-524","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-4w7w-5xrc-9h26","versionConstraint":">=7.0.0,<7.30.1 (semantic)"},"fix":{"suggestedVersion":"7.30.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-72x6-4j93-7w86","dataSource":"https://github.com/advisories/GHSA-72x6-4j93-7w86","namespace":"github:language:go","severity":"Low","urls":["https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86","https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1","https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255","https://github.com/moby/buildkit/releases/tag/v0.31.1"],"description":"BuildKit has a possible runtime DoS via unbounded group parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61712","epss":0.00399,"percentile":0.34096,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61712","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-08-20","kind":"first-observed"}]},"advisories":[],"risk":0.10573499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-61712","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61712","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1","https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255","https://github.com/moby/buildkit/releases/tag/v0.31.1","https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86"],"description":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61712","epss":0.00399,"percentile":0.34096,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61712","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/buildkit","version":"v0.30.0"}},"found":{"vulnerabilityID":"GHSA-72x6-4j93-7w86","versionConstraint":"<=0.31.0 (go)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:golang/github.com/moby/buildkit@v0.30.0?package-id=873370e02c0bf868","name":"github.com/moby/buildkit","version":"v0.30.0","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:buildkit:v0.30.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/buildkit@v0.30.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:OsK8T3BaYH52UNStpKd7gytDtHWWt2Fawak/lAPWatU="}}},{"vulnerability":{"id":"GHSA-r53p-7pc4-xj5r","dataSource":"https://github.com/advisories/GHSA-r53p-7pc4-xj5r","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r","https://nvd.nist.gov/vuln/detail/CVE-2026-18540","https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329","https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95","https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548","https://hackerone.com/reports/3900104","https://hackerone.com/reports/3900615","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v6.28.1","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to downstream response splitting via retry interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18540","epss":0.00309,"percentile":0.23786,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.10351499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-18540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"],"description":"undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18540","epss":0.00309,"percentile":0.23786,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-18540","cwe":"CWE-444","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-r53p-7pc4-xj5r","versionConstraint":">=7.0.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.33"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.0.33?package-id=b9ba4353f73079ce","name":"tmp","version":"0.0.33","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:raszi:tmp:0.0.33:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.33","upstreams":[]}},{"vulnerability":{"id":"GHSA-333x-w4r6-6crp","dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.10117},"relatedVulnerabilities":[{"id":"CVE-2026-110725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.60.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.60.0?package-id=efbf0cafe9358246","name":"golang.org/x/net","version":"v0.60.0","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.60.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU="}}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.60.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.60.0?package-id=6cfa63a95d7e7387","name":"golang.org/x/net","version":"v0.60.0","type":"go-module","locations":[{"path":"/cliv2/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.60.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU="}}},{"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to improper path equivalence in relative reference normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-110095","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.0.6"}},"found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.0.6?package-id=c14f787584c8491e","name":"fast-uri","version":"3.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-vmf3-w455-68vh","dataSource":"https://github.com/advisories/GHSA-vmf3-w455-68vh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.16"],"state":"fixed","available":[{"version":"7.5.16","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.09281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53655","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-vmf3-w455-68vh","versionConstraint":"<=7.5.15 (semantic)"},"fix":{"suggestedVersion":"7.5.16"}}],"artifact":{"id":"pkg:npm/tar@6.2.1?package-id=16271520fdc48d20","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.60.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.60.0?package-id=efbf0cafe9358246","name":"golang.org/x/net","version":"v0.60.0","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.60.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU="}}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.60.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.60.0?package-id=6cfa63a95d7e7387","name":"golang.org/x/net","version":"v0.60.0","type":"go-module","locations":[{"path":"/cliv2/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.60.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU="}}},{"vulnerability":{"id":"GHSA-m5mm-p8h7-m29v","dataSource":"https://github.com/advisories/GHSA-m5mm-p8h7-m29v","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3"],"description":"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115897","epss":0.00307,"percentile":0.23501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115897","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.1.3"],"state":"fixed","available":[{"version":"7.1.3","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.078285},"relatedVulnerabilities":[{"id":"CVE-2026-115897","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115897","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61","https://github.com/yahoo/serialize-javascript/pull/235","https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3","https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v"],"description":"Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115897","epss":0.00307,"percentile":0.23501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115897","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.0"}},"found":{"vulnerabilityID":"GHSA-m5mm-p8h7-m29v","versionConstraint":"<7.1.3 (semantic)"},"fix":{"suggestedVersion":"7.1.3"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.0?package-id=64612a3ac0f67076","name":"serialize-javascript","version":"6.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.0:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-38r7-794h-5758","dataSource":"https://github.com/advisories/GHSA-38r7-794h-5758","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758","https://nvd.nist.gov/vuln/detail/CVE-2025-68157"],"description":"webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":1.2,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68157","epss":0.00233,"percentile":0.14247,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-68157","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.104.0"],"state":"fixed","available":[{"version":"5.104.0","date":"2026-02-06","kind":"first-observed"}]},"advisories":[],"risk":0.078055},"relatedVulnerabilities":[{"id":"CVE-2025-68157","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68157","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/webpack/webpack/security/advisories/GHSA-38r7-794h-5758"],"description":"Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":1.2,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68157","epss":0.00233,"percentile":0.14247,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-68157","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack","version":"5.54.0"}},"found":{"vulnerabilityID":"GHSA-38r7-794h-5758","versionConstraint":">=5.49.0,<5.104.0 (semantic)"},"fix":{"suggestedVersion":"5.104.0"}}],"artifact":{"id":"pkg:npm/webpack@5.54.0?package-id=a0c270983ec54e9c","name":"webpack","version":"5.54.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack.js:webpack:5.54.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/webpack@5.54.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8fgc-7cc6-rx7x","dataSource":"https://github.com/advisories/GHSA-8fgc-7cc6-rx7x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/webpack/webpack/security/advisories/GHSA-8fgc-7cc6-rx7x","https://nvd.nist.gov/vuln/detail/CVE-2025-68458"],"description":"webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":1.2,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68458","epss":0.00233,"percentile":0.14247,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-68458","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.104.1"],"state":"fixed","available":[{"version":"5.104.1","date":"2026-02-06","kind":"first-observed"}]},"advisories":[],"risk":0.078055},"relatedVulnerabilities":[{"id":"CVE-2025-68458","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68458","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/webpack/webpack/security/advisories/GHSA-8fgc-7cc6-rx7x"],"description":"Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). This issue has been patched in version 5.104.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":1.2,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68458","epss":0.00233,"percentile":0.14247,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-68458","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"webpack","version":"5.54.0"}},"found":{"vulnerabilityID":"GHSA-8fgc-7cc6-rx7x","versionConstraint":">=5.49.0,<=5.104.0 (semantic)"},"fix":{"suggestedVersion":"5.104.1"}}],"artifact":{"id":"pkg:npm/webpack@5.54.0?package-id=a0c270983ec54e9c","name":"webpack","version":"5.54.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:webpack.js:webpack:5.54.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/webpack@5.54.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2gqq-gqf2-x968","dataSource":"https://github.com/advisories/GHSA-2gqq-gqf2-x968","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968","https://nvd.nist.gov/vuln/detail/CVE-2026-84947","https://github.com/nodejs/undici/commit/21693f406f0142f3504192e9f9b022dcf84782ae","https://github.com/nodejs/undici/commit/6d583124e7cf60b640097d64144ed633cc450584","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to response truncation via oversized chunked responses in the dump interceptor","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84947","epss":0.00196,"percentile":0.094,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84947","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-84947","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.06566},"relatedVulnerabilities":[{"id":"CVE-2026-84947","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84947","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968"],"description":"undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion early once the accumulated size reaches the maximum, without pausing or aborting the request. Because the underlying parser keeps delivering body bytes, a second completion signal fires and trips an internal assertion, which aborts the request and tears down the connection. The application is left observing a misleading successful status with an empty or truncated body while the connection has actually been disconnected. This affects undici versions from 7.1.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84947","epss":0.00196,"percentile":0.094,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84947","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-84947","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-2gqq-gqf2-x968","versionConstraint":">=7.1.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6hwc-9h8r-3vmf","dataSource":"https://github.com/advisories/GHSA-6hwc-9h8r-3vmf","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-6624","https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df","https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18","https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli","https://github.com/snyk/cli/releases/tag/v1.1297.3","https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607"],"description":"Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.7,"impactScore":6.1},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":1.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-6624","epss":0.00179,"percentile":0.07484,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-6624","cwe":"CWE-532","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2025-6624","cwe":"CWE-532","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["1.1297.3"],"state":"fixed","available":[{"version":"1.1297.3","date":"2025-06-30","kind":"first-observed"}]},"advisories":[],"risk":0.06444},"relatedVulnerabilities":[{"id":"CVE-2025-6624","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6624","namespace":"nvd:cpe","severity":"Low","urls":["https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli","https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df","https://github.com/snyk/cli/releases/tag/v1.1297.3","https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18","https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607"],"description":"Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode.\r\rThe issue affects the following Snyk commands:\r\r1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and  --username/-u).\r\r2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs.\r\r3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.2},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.7,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-6624","epss":0.00179,"percentile":0.07484,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-6624","cwe":"CWE-532","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2025-6624","cwe":"CWE-532","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"snyk","version":"1.0.0-monorepo"}},"found":{"vulnerabilityID":"GHSA-6hwc-9h8r-3vmf","versionConstraint":"<1.1297.3 (semantic)"},"fix":{"suggestedVersion":"1.1297.3"}}],"artifact":{"id":"pkg:npm/snyk@1.0.0-monorepo?package-id=846527b067d5b74a","name":"snyk","version":"1.0.0-monorepo","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:snyk:snyk:1.0.0-monorepo:*:*:*:*:*:*:*"],"purl":"pkg:npm/snyk@1.0.0-monorepo","upstreams":[]}},{"vulnerability":{"id":"GHSA-6hwc-9h8r-3vmf","dataSource":"https://github.com/advisories/GHSA-6hwc-9h8r-3vmf","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-6624","https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df","https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18","https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli","https://github.com/snyk/cli/releases/tag/v1.1297.3","https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607"],"description":"Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.7,"impactScore":6.1},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":1.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-6624","epss":0.00179,"percentile":0.07484,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-6624","cwe":"CWE-532","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2025-6624","cwe":"CWE-532","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["1.1297.3"],"state":"fixed","available":[{"version":"1.1297.3","date":"2025-06-30","kind":"first-observed"}]},"advisories":[],"risk":0.06444},"relatedVulnerabilities":[{"id":"CVE-2025-6624","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6624","namespace":"nvd:cpe","severity":"Low","urls":["https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli","https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df","https://github.com/snyk/cli/releases/tag/v1.1297.3","https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18","https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607"],"description":"Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode.\r\rThe issue affects the following Snyk commands:\r\r1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and  --username/-u).\r\r2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs.\r\r3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.2},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.7,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-6624","epss":0.00179,"percentile":0.07484,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-6624","cwe":"CWE-532","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2025-6624","cwe":"CWE-532","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"snyk","version":"1.0.0-monorepo"}},"found":{"vulnerabilityID":"GHSA-6hwc-9h8r-3vmf","versionConstraint":"<1.1297.3 (semantic)"},"fix":{"suggestedVersion":"1.1297.3"}}],"artifact":{"id":"pkg:npm/snyk@1.0.0-monorepo?package-id=e49646e4373d0b2b","name":"snyk","version":"1.0.0-monorepo","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["Apache-2.0"],"cpes":["cpe:2.3:a:snyk:snyk:1.0.0-monorepo:*:*:*:*:*:*:*"],"purl":"pkg:npm/snyk@1.0.0-monorepo","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.20.12"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.20.12?package-id=42d48854cc215ae9","name":"@babel/core","version":"7.20.12","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.20.12:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.20.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.24.0"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.24.0?package-id=600fdccb68013ee4","name":"@babel/core","version":"7.24.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.24.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.24.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8436-99hf-9mmv","dataSource":"https://github.com/advisories/GHSA-8436-99hf-9mmv","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv","https://nvd.nist.gov/vuln/detail/CVE-2026-85008","https://github.com/nodejs/undici/commit/2be07bf97b3022e0324142d31f99f6e019d815e3","https://github.com/nodejs/undici/commit/b61d9432bac7caac51273ad209862e4c0bf935ae","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/releases/tag/v7.29.1","https://github.com/nodejs/undici/releases/tag/v8.10.2"],"description":"undici vulnerable to caching and replay of unsafe HTTP method responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85008","epss":0.00118,"percentile":0.0169,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85008","cwe":"CWE-345","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["7.29.1"],"state":"fixed","available":[{"version":"7.29.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.039529999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-85008","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85008","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv"],"description":"undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85008","epss":0.00118,"percentile":0.0169,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85008","cwe":"CWE-345","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undici","version":"7.29.0"}},"found":{"vulnerabilityID":"GHSA-8436-99hf-9mmv","versionConstraint":">=7.0.0,<7.29.1 (semantic)"},"fix":{"suggestedVersion":"7.29.1"}}],"artifact":{"id":"pkg:npm/undici@7.29.0?package-id=cf0b945d55784532","name":"undici","version":"7.29.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodejs:undici:7.29.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undici@7.29.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-cxww-7g56-2vh6","dataSource":"https://github.com/advisories/GHSA-cxww-7g56-2vh6","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6","https://github.com/advisories/GHSA-6q32-hq47-5qq3","https://snyk.io/research/zip-slip-vulnerability","https://github.com/actions/download-artifact/releases/tag/v4.1.3"],"description":"@actions/download-artifact has an Arbitrary File Write via artifact extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"actions/download-artifact","version":"v4"}},"found":{"vulnerabilityID":"GHSA-cxww-7g56-2vh6","versionConstraint":">=4.0.0,<4.1.3 (unknown)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:github/actions/download-artifact@v4?package-id=6d24d2fce3f6c45f","name":"actions/download-artifact","version":"v4","type":"github-action","locations":[{"path":"/.github/workflows/deployment-monitor.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download_artifact:v4:*:*:*:*:*:*:*"],"purl":"pkg:github/actions/download-artifact@v4","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.15.1"],"state":"fixed","available":[{"version":"3.15.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=3.0.0,<3.15.1 (semantic)"},"fix":{"suggestedVersion":"3.15.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=a9efc5a07e1f6ee7","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/ts-binary-wrapper/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5c6j-r48x-rmvq","dataSource":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq","https://nvd.nist.gov/vuln/detail/CVE-2020-7660","https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9","https://github.com/advisories/GHSA-hxcc-f52p-wc94","https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3"],"description":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"fix":{"versions":["7.0.3"],"state":"fixed","available":[{"version":"7.0.3","date":"2026-02-28","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serialize-javascript","version":"6.0.0"}},"found":{"vulnerabilityID":"GHSA-5c6j-r48x-rmvq","versionConstraint":"<=7.0.2 (semantic)"},"fix":{"suggestedVersion":"7.0.3"}}],"artifact":{"id":"pkg:npm/serialize-javascript@6.0.0?package-id=64612a3ac0f67076","name":"serialize-javascript","version":"6.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:verizon:serialize-javascript:6.0.0:*:*:*:*:node.js:*:*","cpe:2.3:a:yahoo:serialize_javascript:6.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/serialize-javascript@6.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-7rx3-28cr-v5wh","dataSource":"https://github.com/advisories/GHSA-7rx3-28cr-v5wh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh","https://github.com/advisories/GHSA-765h-qjxv-5f44","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"],"description":"Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-7rx3-28cr-v5wh","versionConstraint":">=4.6.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-442j-39wm-28r2","dataSource":"https://github.com/advisories/GHSA-442j-39wm-28r2","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"],"description":"Handlebars.js has a Property Access Validation Bypass in container.lookup","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.8"}},"found":{"vulnerabilityID":"GHSA-442j-39wm-28r2","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.8?package-id=f2bdc7bec7ce9c81","name":"handlebars","version":"4.7.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.8:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.8","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.57.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.57.0?package-id=c5e2a87239f7ca07","name":"golang.org/x/crypto","version":"v0.57.0","type":"go-module","locations":[{"path":"/cliv2-private/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.57.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.57.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M="}}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.57.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.57.0?package-id=16406e50667187a8","name":"golang.org/x/crypto","version":"v0.57.0","type":"go-module","locations":[{"path":"/cliv2/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.57.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.57.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M="}}}],"source":{"type":"file","target":"snyk/cli"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:08:02.628735356Z"}}