Every CVE Search/ Get API key

CVE-2026-14257

brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

7.5 HighFix available

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.64%Up 0.3 points since Jul 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Record
CVE-2026-14257
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-48285 7.5

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Record
EUVD-2026-48285
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mh99-v99m-4gvg 7.5

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

Summary

expand() bounds the number of results it produces (the max option, 100_000 by default) but not their length. By chaining many brace groups, an attacker keeps the result count under max while making every result grow with the number of groups. Building max long results — plus the intermediate arrays combined at each brace group — exhausts memory and crashes the Node process with an uncatchable out-of-memory error. try/catch around expand() does not help: the fatal error terminates the process.

A ~7.5 KB input ('{a,b}'.repeat(1500)) is enough to crash a default Node process.

Details

For N chained brace groups such as '{a,b}'.repeat(N):

  • the result count is 2^N, immediately capped at max (100_000), so the max protection appears to hold, but
  • each result is N characters long, so the total output size is max × N characters, which grows without bound in N.

expand_ combines each brace set with the fully-expanded tail:

const post = m.post.length ? expand_(m.post, max, false) : ['']
...
for (let j = 0; j < N.length; j++) {
  for (let k = 0; k < post.length && expansions.length < max; k++) {
    const expansion = pre + N[j] + post[k]   // grows one group longer per level
    ...
    expansions.push(expansion)
  }
}

The loop guard expansions.length < max limits how many strings are built, but nothing limits how long they get. Each recursion level materializes another array of up to max strings, one character longer than the level below, and — because V8 represents pre + N[j] + post[k] as a cons-string (rope) that references post[k] — those intermediate strings stay reachable through the whole chain. Memory therefore scales with max × N.

Measured on 5.0.7 ('{a,b}'.repeat(N), default max):

| groups (N) | input bytes | result count | peak RSS | |---|---|---|---| | 20 | 100 | 100,000 | ~80 MB | | 50 | 250 | 100,000 | ~214 MB | | 100 | 500 | 100,000 | ~409 MB | | 300 | 1,500 | 100,000 | ~1,148 MB | | 1500 | 7,500 | — | OOM crash |

Proof of concept

const { expand } = require('brace-expansion')

// ~7.5 KB input — crashes the process with a fatal, uncatchable OOM:
//   FATAL ERROR: ... JavaScript heap out of memory
try {
  expand('{a,b}'.repeat(1500))
} catch (e) {
  // never reached — the process is already dead
}

Impact

Any application that passes attacker-influenced strings to brace-expansion.expand() — directly, or transitively via minimatch / glob brace patterns — can be crashed by a small request. Because the failure is a fatal V8 out-of-memory error rather than a thrown exception, it cannot be caught and it takes down the whole worker/process, denying service.

Remediation

Upgrade to a patched release. The fix bounds the total number of characters a single expand() call may accumulate (EXPANSION_MAX_LENGTH, default 4_000_000, configurable via a new maxLength option), applied inside the output-building loops so intermediate arrays are bounded too. Once the limit is reached, output is truncated — consistent with how max already truncates — instead of growing without bound. The limit sits well above any realistic expansion (100,000 results hitting max measure ~1M characters), so legitimate input is unaffected.

After the fix, '{a,b}'.repeat(1500) returns a bounded, truncated result in ~0.7 s using ~340 MB and never crashes, including under a constrained 512 MB heap.

The fix bounds memory but the algorithm still rebuilds intermediate arrays at each level (roughly O(N × maxLength) work on this input class). A streaming rewrite that produces output in O(total output size) can be a non-urgent follow-up.

If immediate upgrade isn't possible, avoid passing untrusted input to expand() / glob brace patterns, or pass a small explicit max and maxLength.

Record
GHSA-mh99-v99m-4gvg
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
NVD 7.5

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Record
CVE-2026-14257
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 7.5

brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Record
CVE-2026-14257
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2026-14257 7.5

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Record
DEBIAN-CVE-2026-14257
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSVGHSA-mh99-v99m-4gvg 7.5

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

Summary

expand() bounds the number of results it produces (the max option, 100_000 by default) but not their length. By chaining many brace groups, an attacker keeps the result count under max while making every result grow with the number of groups. Building max long results — plus the intermediate arrays combined at each brace group — exhausts memory and crashes the Node process with an uncatchable out-of-memory error. try/catch around expand() does not help: the fatal error terminates the process.

A ~7.5 KB input ('{a,b}'.repeat(1500)) is enough to crash a default Node process.

Details

For N chained brace groups such as '{a,b}'.repeat(N):

  • the result count is 2^N, immediately capped at max (100_000), so the max protection appears to hold, but
  • each result is N characters long, so the total output size is max × N characters, which grows without bound in N.

expand_ combines each brace set with the fully-expanded tail:

const post = m.post.length ? expand_(m.post, max, false) : ['']
...
for (let j = 0; j < N.length; j++) {
  for (let k = 0; k < post.length && expansions.length < max; k++) {
    const expansion = pre + N[j] + post[k]   // grows one group longer per level
    ...
    expansions.push(expansion)
  }
}

The loop guard expansions.length < max limits how many strings are built, but nothing limits how long they get. Each recursion level materializes another array of up to max strings, one character longer than the level below, and — because V8 represents pre + N[j] + post[k] as a cons-string (rope) that references post[k] — those intermediate strings stay reachable through the whole chain. Memory therefore scales with max × N.

Measured on 5.0.7 ('{a,b}'.repeat(N), default max):

| groups (N) | input bytes | result count | peak RSS | |---|---|---|---| | 20 | 100 | 100,000 | ~80 MB | | 50 | 250 | 100,000 | ~214 MB | | 100 | 500 | 100,000 | ~409 MB | | 300 | 1,500 | 100,000 | ~1,148 MB | | 1500 | 7,500 | — | OOM crash |

Proof of concept

const { expand } = require('brace-expansion')

// ~7.5 KB input — crashes the process with a fatal, uncatchable OOM:
//   FATAL ERROR: ... JavaScript heap out of memory
try {
  expand('{a,b}'.repeat(1500))
} catch (e) {
  // never reached — the process is already dead
}

Impact

Any application that passes attacker-influenced strings to brace-expansion.expand() — directly, or transitively via minimatch / glob brace patterns — can be crashed by a small request. Because the failure is a fatal V8 out-of-memory error rather than a thrown exception, it cannot be caught and it takes down the whole worker/process, denying service.

Remediation

Upgrade to a patched release. The fix bounds the total number of characters a single expand() call may accumulate (EXPANSION_MAX_LENGTH, default 4_000_000, configurable via a new maxLength option), applied inside the output-building loops so intermediate arrays are bounded too. Once the limit is reached, output is truncated — consistent with how max already truncates — instead of growing without bound. The limit sits well above any realistic expansion (100,000 results hitting max measure ~1M characters), so legitimate input is unaffected.

After the fix, '{a,b}'.repeat(1500) returns a bounded, truncated result in ~0.7 s using ~340 MB and never crashes, including under a constrained 512 MB heap.

The fix bounds memory but the algorithm still rebuilds intermediate arrays at each level (roughly O(N × maxLength) work on this input class). A streaming rewrite that produces output in O(total output size) can be a non-urgent follow-up.

If immediate upgrade isn't possible, avoid passing untrusted input to expand() / glob brace patterns, or pass a small explicit max and maxLength.

Record
GHSA-mh99-v99m-4gvg
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVRHSA-2026:45360 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:45360
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:45381 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:45381
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:45784 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:45784
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:50290 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:50290
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:54183 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:54183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:54371 8.6

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:54371
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:54389 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:54389
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:54530 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:54530
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:55541 8.6

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:55541
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:55601 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:55601
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:55603 8.6

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:55603
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:57590 8.6

Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update

Record
RHSA-2026:57590
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:58819 8.6

Red Hat Security Advisory: nodejs24 security update

Record
RHSA-2026:58819
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:62416 8.6

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:62416
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:64817 8.6

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:64817
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:54371 8.6

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:54371
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:54530 8.6

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:54530
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:55541 8.6

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55541
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:55601 8.6

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55601
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:55603 8.6

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55603
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2026:58819 8.6

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:58819
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-14257 7.5

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Record
UBUNTU-CVE-2026-14257
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:54371 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:54371
Updated
2026-11-02
OSVALSA-2026:54530 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:54530
Updated
2026-11-02
OSVALSA-2026:55541 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55541
Updated
2026-11-02
OSVALSA-2026:55601 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55601
Updated
2026-11-02
OSVALSA-2026:55603 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
  • sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55603
Updated
2026-11-02
OSVALSA-2026:58819 No score

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
  • ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
  • ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:58819
Updated
2026-11-02
OSVAZL-94520 No score

CVE-2026-14257 affecting package js-jquery 3.5.0-4

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Record
AZL-94520
Updated
2026-11-05
OSVAZL-94535 No score

CVE-2026-14257 affecting package nodejs-nodemon 2.0.3-5

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Record
AZL-94535
Updated
2026-11-05
OSVCLSA-2026-1774311647 No score

TuxCare security update for formidable (4 CVEs)

TuxCare rebuilt formidable to address 4 CVEs. Fixed in 2.1.2-tuxcare.1.

Record
CLSA-2026-1774311647
Updated
2026-11-02
OSVCLSA-2026-1781830551 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.1.

Record
CLSA-2026-1781830551
Updated
2026-11-02
OSVCLSA-2026-1784856030 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.1-tuxcare.3.

Record
CLSA-2026-1784856030
Updated
2026-11-02
OSVCLSA-2026-1785291241 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.2-tuxcare.1.

Record
CLSA-2026-1785291241
Updated
2026-11-02
OSVCLSA-2026-1790252886 No score

nodejs: Fix of 5 CVEs

  • CVE-2026-14257: bound the total number of characters brace expansion may accumulate in the bundled npm brace-expansion copies, so chained brace groups can no longer grow every result until the process dies with an uncatchable out-of-memory error
  • CVE-2026-59874: refuse a negative entry size in the bundled npm node-tar copy, both when decoding a base-256 header field and when parsing a pax size record, so a crafted archive can no longer stall tar.replace on a scan that never advances past the same header
  • CVE-2026-69152: charge the intermediate arrays built for comma alternatives and padded sequences against that same length budget, closing a bypass that exhausted memory before the CVE-2026-14257 bound could take effect
Record
CLSA-2026-1790252886
Updated
2026-11-02
OSVCLSA-2026-1790253961 No score

nodejs: Fix of 5 CVEs

  • CVE-2026-14257: bound the total number of characters brace expansion may accumulate in the bundled npm brace-expansion copies, so chained brace groups can no longer grow every result until the process dies with an uncatchable out-of-memory error
  • CVE-2026-59874: refuse a negative entry size in the bundled npm node-tar copy, both when decoding a base-256 header field and when parsing a pax size record, so a crafted archive can no longer stall tar.replace on a scan that never advances past the same header
  • CVE-2026-69152: charge the intermediate arrays built for comma alternatives and padded sequences against that same length budget, closing a bypass that exhausted memory before the CVE-2026-14257 bound could take effect
Record
CLSA-2026-1790253961
Updated
2026-11-02
OSVCLSA-2026-1791200030 No score

TuxCare security update for brace-expansion (2 CVEs)

TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 1.1.16-tuxcare.4.

Record
CLSA-2026-1791200030
Updated
2026-11-02
OSVCLSA-2026-1791798665 No score

TuxCare security update for brace-expansion (6 CVEs)

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.

Record
CLSA-2026-1791798665
Updated
2026-11-02
OSVCLSA-2026-1791806331 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3.

Record
CLSA-2026-1791806331
Updated
2026-11-02
OSVCLSA-2026-1792232943 No score

TuxCare security update for brace-expansion (3 CVEs)

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.14-tuxcare.4.

Record
CLSA-2026-1792232943
Updated
2026-11-02
OSVCLSA-2026-1792233116 No score

TuxCare security update for brace-expansion (3 CVEs)

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.15-tuxcare.4.

Record
CLSA-2026-1792233116
Updated
2026-11-02
OSVCLSA-2026-1792233308 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 4.0.1-tuxcare.3.

Record
CLSA-2026-1792233308
Updated
2026-11-02
OSVCLSA-2026-1792243228 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 2.0.2-tuxcare.4.

Record
CLSA-2026-1792243228
Updated
2026-11-02
OSVCLSA-2026-1792448853 No score

TuxCare security update for brace-expansion (6 CVEs)

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.6-tuxcare.1.

Record
CLSA-2026-1792448853
Updated
2026-11-02
OSVCLSA-2026-1792453589 No score

TuxCare security update for brace-expansion (7 CVEs)

TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.

Record
CLSA-2026-1792453589
Updated
2026-11-02
OSVCLSA-2026-1792479350 No score

TuxCare security update for brace-expansion (7 CVEs)

TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.

Record
CLSA-2026-1792479350
Updated
2026-11-02
OSVCLSA-2026-1793808172 No score

TuxCare security update for brace-expansion (3 CVEs)

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.3-tuxcare.3.

Record
CLSA-2026-1793808172
Updated
2026-11-04

Affected products

Affected packages

Affected packages
PackageAffectedFixed
brace-expansion
npm
 4.0.0 up to 5.0.8
5.0.8
brace-expansion
npm
 3.0.0 up to 3.0.3
3.0.3
brace-expansion
npm
 2.0.0 up to 2.1.3
2.1.3
brace-expansion
npm
 before 1.1.17
1.1.17
nodejs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-docs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-libs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module_el8.10.0+4250+09238ed4
1:24.18.0-3.module_el8.10.0+4250+09238ed4
nodejs-nodemon
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
Show 257 moreShow less
Affected packages
PackageAffectedFixed
nodejs-packaging
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4
1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4
v8-13.6-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4
3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4
nodejs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-devel
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-docs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-libs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module_el8.10.0+4251+b427b8a5
1:22.23.1-3.module_el8.10.0+4251+b427b8a5
nodejs-nodemon
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3.1.14-2.module_el8.10.0+4252+aedd4c30
3.1.14-2.module_el8.10.0+4252+aedd4c30
nodejs-packaging
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:10.9.8-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
1:10.9.8-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
v8-12.4-devel
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
nodejs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-devel
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-docs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-full-i18n
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-libs
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-npm
AlmaLinux:10
From an advisory covering 3 CVEs
 before 1:10.9.8-1.22.23.1.6.el10_2
1:10.9.8-1.22.23.1.6.el10_2
nodejs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-docs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module_el9.8.0+291+0bb98cce
1:22.23.1-3.module_el9.8.0+291+0bb98cce
nodejs-nodemon
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.1.14-2.module_el9.8.0+291+0bb98cce
3.1.14-2.module_el9.8.0+291+0bb98cce
nodejs-packaging
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
npm
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce
1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce
v8-12.4-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce
3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce
nodejs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-docs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
1:24.18.0-6.module_el9.8.0+292+f4eaf8b2
nodejs-nodemon
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
1:11.16.0-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
v8-13.6-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2
nodejs24
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1:11.16.0-1.24.18.0.5.el10_2
1:11.16.0-1.24.18.0.5.el10_2
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 1.1.11-tuxcare.0 up to 1.1.11-tuxcare.1, plus listed versions
1.1.11
1.1.11-tuxcare.1
brace-expansion
TuxCare:npm
 2.0.1-tuxcare.0 up to 2.0.1-tuxcare.3, plus listed versions
2.0.12.0.1-tuxcare.12.0.1-tuxcare.2
2.0.1-tuxcare.3
brace-expansion
TuxCare:npm
 2.1.2-tuxcare.0 up to 2.1.2-tuxcare.1, plus listed versions
2.1.2
2.1.2-tuxcare.1
nodejs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els19
1:16.20.2-8.el9_2.tuxcare.els19
nodejs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els19
1:16.20.2-8.el9_2.tuxcare.els19
nodejs-docs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els19
1:16.20.2-8.el9_2.tuxcare.els19
nodejs-full-i18n
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els19
1:16.20.2-8.el9_2.tuxcare.els19
nodejs-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els19
1:16.20.2-8.el9_2.tuxcare.els19
npm
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els19
1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els19
v8-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els19
2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els19
nodejs
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els19
1:16.20.2-8.el9_6.tuxcare.els19
nodejs-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els19
1:16.20.2-8.el9_6.tuxcare.els19
nodejs-docs
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els19
1:16.20.2-8.el9_6.tuxcare.els19
nodejs-full-i18n
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els19
1:16.20.2-8.el9_6.tuxcare.els19
nodejs-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els19
1:16.20.2-8.el9_6.tuxcare.els19
npm
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els19
1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els19
v8-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els19
2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els19
brace-expansion
TuxCare:npm
From an advisory covering 2 CVEs
 1.1.16-tuxcare.0 up to 1.1.16-tuxcare.4, plus listed versions
1.1.161.1.16-tuxcare.11.1.16-tuxcare.21.1.16-tuxcare.3
1.1.16-tuxcare.4
brace-expansion
TuxCare:npm
From an advisory covering 6 CVEs
 5.0.5-tuxcare.0 up to 5.0.5-tuxcare.2, plus listed versions
5.0.55.0.5-tuxcare.1
5.0.5-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 5.0.4-tuxcare.0 up to 5.0.4-tuxcare.3, plus listed versions
5.0.45.0.4-tuxcare.15.0.4-tuxcare.2
5.0.4-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 3 CVEs
 1.1.14-tuxcare.0 up to 1.1.14-tuxcare.4, plus listed versions
1.1.141.1.14-tuxcare.11.1.14-tuxcare.21.1.14-tuxcare.3
1.1.14-tuxcare.4
brace-expansion
TuxCare:npm
From an advisory covering 3 CVEs
 1.1.15-tuxcare.0 up to 1.1.15-tuxcare.4, plus listed versions
1.1.151.1.15-tuxcare.11.1.15-tuxcare.21.1.15-tuxcare.3
1.1.15-tuxcare.4
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 4.0.1-tuxcare.0 up to 4.0.1-tuxcare.3, plus listed versions
4.0.14.0.1-tuxcare.14.0.1-tuxcare.2
4.0.1-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
 2.0.2-tuxcare.0 up to 2.0.2-tuxcare.4, plus listed versions
2.0.22.0.2-tuxcare.12.0.2-tuxcare.22.0.2-tuxcare.3
2.0.2-tuxcare.4
brace-expansion
TuxCare:npm
From an advisory covering 6 CVEs
 5.0.6-tuxcare.0 up to 5.0.6-tuxcare.1, plus listed versions
5.0.6
5.0.6-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 7 CVEs
 5.0.3-tuxcare.0 up to 5.0.3-tuxcare.1, plus listed versions
5.0.3
5.0.3-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 7 CVEs
 5.0.2-tuxcare.0 up to 5.0.2-tuxcare.1, plus listed versions
5.0.2
5.0.2-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 3 CVEs
 1.1.3-tuxcare.0 up to 1.1.3-tuxcare.3, plus listed versions
1.1.31.1.3-tuxcare.11.1.3-tuxcare.2
1.1.3-tuxcare.3
node-brace-expansion
Debian:12
 All versions, plus listed versions
2.0.1+~1.1.0-12.0.1+~1.1.0-22.0.1-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
 None known
node-brace-expansion
Debian:13
 All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
 None known
node-brace-expansion
Debian:14
 All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
 None known
nodejs26
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:26.5.0-1.4.hum1
0:26.5.0-1.4.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:26.5.0-1.4.hum1
0:26.5.0-1.4.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:26.5.0-1.4.hum1
0:26.5.0-1.4.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:26.5.0-1.4.hum1
0:26.5.0-1.4.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:26.5.0-1.4.hum1
0:26.5.0-1.4.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:26.5.0-1.4.hum1
0:26.5.0-1.4.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:11.17.0-1.26.5.0.1.4.hum1
0:11.17.0-1.26.5.0.1.4.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:26.5.0-1.4.hum1
0:26.5.0-1.4.hum1
v8-14.6-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:14.6.202.34-1.26.5.0.1.4.hum1
0:14.6.202.34-1.26.5.0.1.4.hum1
nodejs22
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:22.23.1-2.3.hum1
0:22.23.1-2.3.hum1
nodejs22-bin
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:22.23.1-2.3.hum1
0:22.23.1-2.3.hum1
nodejs22-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:22.23.1-2.3.hum1
0:22.23.1-2.3.hum1
nodejs22-docs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:22.23.1-2.3.hum1
0:22.23.1-2.3.hum1
nodejs22-full-i18n
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:22.23.1-2.3.hum1
0:22.23.1-2.3.hum1
nodejs22-libs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:22.23.1-2.3.hum1
0:22.23.1-2.3.hum1
nodejs22-npm
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:10.9.8-1.22.23.1.2.3.hum1
0:10.9.8-1.22.23.1.2.3.hum1
nodejs22-npm-bin
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:22.23.1-2.3.hum1
0:22.23.1-2.3.hum1
v8-12.4-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:12.4.254.21-1.22.23.1.2.3.hum1
0:12.4.254.21-1.22.23.1.2.3.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.0-0.5.hum1
0:24.18.0-0.5.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.0-0.5.hum1
0:24.18.0-0.5.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.0-0.5.hum1
0:24.18.0-0.5.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.0-0.5.hum1
0:24.18.0-0.5.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.0-0.5.hum1
0:24.18.0-0.5.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.0-0.5.hum1
0:24.18.0-0.5.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:11.16.0-1.24.18.0.0.5.hum1
0:11.16.0-1.24.18.0.0.5.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.0-0.5.hum1
0:24.18.0-0.5.hum1
grafana12.4
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:12.4.6-0.4.hum1
0:12.4.6-0.4.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.1-0.2.1.hum1
0:24.18.1-0.2.1.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.1-0.2.1.hum1
0:24.18.1-0.2.1.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.1-0.2.1.hum1
0:24.18.1-0.2.1.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.1-0.2.1.hum1
0:24.18.1-0.2.1.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.1-0.2.1.hum1
0:24.18.1-0.2.1.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.1-0.2.1.hum1
0:24.18.1-0.2.1.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:11.16.0-1.24.18.1.0.2.1.hum1
0:11.16.0-1.24.18.1.0.2.1.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:24.18.1-0.2.1.hum1
0:24.18.1-0.2.1.hum1
v8-13.6-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:13.6.233.17-1.24.18.1.0.2.1.hum1
0:13.6.233.17-1.24.18.1.0.2.1.hum1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+24639+56878497
1:24.18.0-3.module+el8.10.0+24639+56878497
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+24639+56878497
0:3.1.14-2.module+el8.10.0+24639+56878497
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+24562+090c6525
0:2021.06-6.module+el8.10.0+24562+090c6525
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+24562+090c6525
0:2021.06-6.module+el8.10.0+24562+090c6525
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497
1:11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497
3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497
nodejs26
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:11.19.0-1.26.7.0.1.5.2.hum1
0:11.19.0-1.26.7.0.1.5.2.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:26.7.0-1.5.2.hum1
0:26.7.0-1.5.2.hum1
v8-14.6-devel
Red Hat:hummingbird:1
From an advisory covering 10 CVEs
 before 0:14.6.202.34-1.26.7.0.1.5.2.hum1
0:14.6.202.34-1.26.7.0.1.5.2.hum1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
1:22.23.1-3.module+el8.10.0+24640+6eba5e6e
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el8.10.0+24640+6eba5e6e
0:3.1.14-2.module+el8.10.0+24640+6eba5e6e
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+24500+8eb51621
0:2021.06-6.module+el8.10.0+24500+8eb51621
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 1:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
1:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 5 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
3:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e
nodejs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:10.9.8-1.22.23.1.6.el10_2
1:10.9.8-1.22.23.1.6.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:22.23.1-3.module+el9.8.0+24637+e0b636e5
1:22.23.1-3.module+el9.8.0+24637+e0b636e5
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el9.8.0+24637+e0b636e5
0:3.1.14-2.module+el9.8.0+24637+e0b636e5
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24156+bb41d456
0:2021.06-6.module+el9.8.0+24156+bb41d456
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+24638+75f46aee
1:24.18.0-6.module+el9.8.0+24638+75f46aee
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:3.1.14-3.module+el9.8.0+24638+75f46aee
0:3.1.14-3.module+el9.8.0+24638+75f46aee
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+24355+35d95b59
0:2021.06-6.module+el9.8.0+24355+35d95b59
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 6 CVEs
 before 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee
3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee
rh-podman-desktop
Red Hat:enterprise_linux:10.2
From an advisory covering 24 CVEs
 before 0:1.1.2-1.el10_2
0:1.1.2-1.el10_2
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 1:11.16.0-1.24.18.0.5.el10_2
1:11.16.0-1.24.18.0.5.el10_2
nodejs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-docs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-full-i18n
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-libs
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:22.23.2-1.module+el9.6.0+24769+299a7e3a
1:22.23.2-1.module+el9.6.0+24769+299a7e3a
nodejs-nodemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:3.1.14-2.module+el9.6.0+24789+4011c12f
0:3.1.14-2.module+el9.6.0+24789+4011c12f
nodejs-packaging
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
nodejs-packaging-bundler
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 0:2021.06-4.module+el9.6.0+23473+45664c2d
0:2021.06-4.module+el9.6.0+23473+45664c2d
npm
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
v8-12.4-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 16 CVEs
 before 3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a
nodejs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-docs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-full-i18n
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-libs
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs-npm
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:10.9.8-1.22.23.2.1.el10_0
1:10.9.8-1.22.23.2.1.el10_0
nodejs22
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs22-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs22-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 1:22.23.2-1.el10_0
1:22.23.2-1.el10_0
nodejs
Rocky Linux:8
From an advisory covering 6 CVEs
 before 1:24.18.0-3.module+el8.10.0+40277+b1b3f89e
1:24.18.0-3.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs
Rocky Linux:8
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el8.10.0+40278+50b003a3
1:22.23.1-3.module+el8.10.0+40278+50b003a3
nodejs-nodemon
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-packaging
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs22
Rocky Linux:10
From an advisory covering 3 CVEs
 before 1:22.23.1-6.el10_2
1:22.23.1-6.el10_2
nodejs
Rocky Linux:9
From an advisory covering 5 CVEs
 before 1:22.23.1-3.module+el9.8.0+40280+057606e8
1:22.23.1-3.module+el9.8.0+40280+057606e8
nodejs-nodemon
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el9.8.0+40264+d9b257bb
0:3.1.14-2.module+el9.8.0+40264+d9b257bb
nodejs-nodemon
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:3.1.14-2.module+el9.8.0+40280+057606e8
0:3.1.14-2.module+el9.8.0+40280+057606e8
nodejs-packaging
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs
Rocky Linux:9
From an advisory covering 6 CVEs
 before 1:24.18.0-6.module+el9.8.0+40281+14cc6568
1:24.18.0-6.module+el9.8.0+40281+14cc6568
nodejs-nodemon
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs24
Rocky Linux:10
From an advisory covering 4 CVEs
 before 1:24.18.0-5.el10_2
1:24.18.0-5.el10_2
brace-expansion
Root:npm
 before 5.0.7-aikido.3
5.0.7-aikido.32.0.1-aikido.42.0.2-aikido.31.1.12-aikido.31.1.15-aikido.21.1.14-aikido.22.1.0-aikido.21.1.16-aikido.15.0.5-aikido.35.0.6-aikido.22.0.3-aikido.22.1.2-aikido.11.1.11-aikido.52.1.1-aikido.21.1.13-aikido.25.0.7-aikido.11.1.12-aikido.42.1.1-aikido.32.0.3-aikido.31.1.11-aikido.65.0.5-aikido.42.0.1-aikido.55.0.6-aikido.32.0.2-aikido.41.1.15-aikido.31.1.13-aikido.35.0.4-aikido.42.1.0-aikido.35.0.4-aikido.52.1.2-aikido.21.1.14-aikido.31.1.16-aikido.21.1.15-aikido.45.0.6-aikido.42.1.0-aikido.45.0.7-aikido.25.0.3-aikido.45.0.3-aikido.55.0.6-aikido.55.0.6-aikido.62.0.1-aikido.61.1.12-aikido.51.1.13-aikido.41.1.12-aikido.61.1.13-aikido.52.0.1-aikido.71.1.14-aikido.41.1.11-aikido.71.1.14-aikido.55.0.7-aikido.42.0.2-aikido.52.0.2-aikido.62.1.0-aikido.55.0.5-aikido.55.0.3-aikido.65.0.8-aikido.15.0.8-aikido.25.0.8-aikido.3
@rootio/brace-expansion
Root:npm
 before 5.0.7-root.io.3
5.0.7-root.io.32.0.1-root.io.42.0.2-root.io.31.1.12-root.io.31.1.15-root.io.21.1.14-root.io.22.1.0-root.io.21.1.16-root.io.15.0.5-root.io.35.0.6-root.io.22.0.3-root.io.22.1.2-root.io.11.1.11-root.io.52.1.1-root.io.21.1.13-root.io.25.0.7-root.io.11.1.12-root.io.42.1.1-root.io.32.0.3-root.io.31.1.11-root.io.65.0.5-root.io.42.0.1-root.io.55.0.6-root.io.32.0.2-root.io.41.1.15-root.io.31.1.13-root.io.35.0.4-root.io.42.1.0-root.io.35.0.4-root.io.52.1.2-root.io.21.1.14-root.io.31.1.16-root.io.21.1.15-root.io.45.0.6-root.io.42.1.0-root.io.45.0.7-root.io.25.0.3-root.io.45.0.3-root.io.55.0.6-root.io.55.0.6-root.io.62.0.1-root.io.61.1.12-root.io.51.1.13-root.io.41.1.12-root.io.61.1.13-root.io.52.0.1-root.io.71.1.14-root.io.41.1.11-root.io.71.1.14-root.io.55.0.7-root.io.42.0.2-root.io.52.0.2-root.io.62.1.0-root.io.55.0.5-root.io.55.0.3-root.io.65.0.8-root.io.15.0.8-root.io.25.0.8-root.io.3
node-brace-expansion
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.8-1
 None known
node-brace-expansion
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.1.8-11.1.11-1
 None known
node-brace-expansion
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.0-12.0.1-1
 None known
node-brace-expansion
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.0.1-22.0.1+~1.1.0-1
 None known
node-brace-expansion
Ubuntu:26.10
 All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-1
 None known
node-brace-expansion
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.0.1+~1.1.0-2
 None known
velociraptor
openSUSE:Tumbleweed
From an advisory covering 40 CVEs
 before 0.76.7.0.git145.b60ef1146-1.1
0.76.7.0.git145.b60ef1146-1.1

History

History
RecordedChangedSources
affectedOSV
affected, aliasesOSV
facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-14257 is a high vulnerability (CVSS 7.5) in Juliangruber Brace-expansion, published July 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 51st percentile. Fixed in brace-expansion 5.0.8.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 177 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 2 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open