Every CVE Search/ Get API key

CVE-2026-26996

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

8.7 HighFix available

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.58%Up 0.5 points since Feb 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Record
CVE-2026-26996
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2026-8032 8.7

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Record
EUVD-2026-8032
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3ppc-4f35-3m26 8.7

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Summary

minimatch is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits.

The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.

PoC

When minimatch compiles a glob pattern, each * becomes [^/]*? in the generated regex. For a pattern like ***************X***:

/^(?!\.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?X[^/]*?[^/]*?[^/]*?$/

When the test string doesn't contain X, the regex engine must try every possible way to distribute the characters across all the [^/]*? groups before concluding no match exists. With N groups and M characters, this is O(C(N+M, N)) — exponential.

Impact

Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This includes:

  • File search/filter UIs that accept glob patterns
  • .gitignore-style filtering with user-defined rules
  • Build tools that accept glob configuration
  • Any API that exposes glob matching to untrusted input

Thanks to @ljharb for back-porting the fix to legacy versions of minimatch.

Record
GHSA-3ppc-4f35-3m26
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1333
Updated
2026-11-02
NVD 8.7

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Record
CVE-2026-26996
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSV 8.7

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Record
CVE-2026-26996
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1333
Updated
2026-11-02
OSVDEBIAN-CVE-2026-26996 7.5

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Record
DEBIAN-CVE-2026-26996
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSVGHSA-3ppc-4f35-3m26 8.7

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Summary

minimatch is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits.

The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.

PoC

When minimatch compiles a glob pattern, each * becomes [^/]*? in the generated regex. For a pattern like ***************X***:

/^(?!\.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?X[^/]*?[^/]*?[^/]*?$/

When the test string doesn't contain X, the regex engine must try every possible way to distribute the characters across all the [^/]*? groups before concluding no match exists. With N groups and M characters, this is O(C(N+M, N)) — exponential.

Impact

Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This includes:

  • File search/filter UIs that accept glob patterns
  • .gitignore-style filtering with user-defined rules
  • Build tools that accept glob configuration
  • Any API that exposes glob matching to untrusted input

Thanks to @ljharb for back-porting the fix to legacy versions of minimatch.

Record
GHSA-3ppc-4f35-3m26
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1333
Updated
2026-11-02
OSVRHSA-2026:13508 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:13508
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:18054 9.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Record
RHSA-2026:18054
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:18055 9.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Record
RHSA-2026:18055
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:24761 7.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:24761
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:7080 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7123 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7302 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7310 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7310
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7350 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7670 7.5

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7675 7.5

Red Hat Security Advisory: nodejs24 security update

Record
RHSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7896 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:7896
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7983 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7983
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8339 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:8339
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:9711 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:9711
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:9874 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:9874
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7080 7.5

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7123 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7302 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7350 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7670 7.5

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7675 7.5

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)

  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7675
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7896 7.5

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7896
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:8339 7.5

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:8339
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-26996 7.5

CVE-2026-26996 in minimatch - Patched by Root

Root has patched CVE-2026-26996 in the minimatch package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-26996
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-26996 8.7

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.

Record
UBUNTU-CVE-2026-26996
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:7080 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7080
Updated
2026-11-02
OSVALSA-2026:7123 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7123
Updated
2026-11-02
OSVALSA-2026:7350 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7350
Updated
2026-11-02
OSVALSA-2026:7670 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7670
Updated
2026-11-02
OSVALSA-2026:7675 No score

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • nodejs: Nodejs denial of service (CVE-2026-21637)
  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
  • undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)
  • Node.js: Node.js: Information disclosure due to fs.realpathSync.native() bypassing filesystem read restrictions (CVE-2026-21715)
  • nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
  • Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
  • Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
  • Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
  • nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7675
Updated
2026-11-02
OSVALSA-2026:7896 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7896
Updated
2026-11-02
OSVALSA-2026:8339 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:8339
Updated
2026-11-02
OSVCLSA-2026-1773015262 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.1.2-tuxcare.1.

Record
CLSA-2026-1773015262
Updated
2026-11-05
OSVCLSA-2026-1774570937 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 5.1.0-tuxcare.3.

Record
CLSA-2026-1774570937
Updated
2026-11-02
OSVCLSA-2026-1774657358 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.0.4-tuxcare.3.

Record
CLSA-2026-1774657358
Updated
2026-11-02
OSVCLSA-2026-1774657359 No score

TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 3.1.5-tuxcare.1.

Record
CLSA-2026-1774657359
Updated
2026-11-02
OSVCLSA-2026-1776782592 No score

nodejs: Fix of 2 CVEs

  • CVE-2026-26996: fix ReDoS in bundled minimatch caused by consecutive non-globstar * characters, by coalescing them during pattern compilation
  • CVE-2026-27904: fix ReDoS in bundled minimatch from nested extglobs and multiple non-adjacent ** wildcards, by limiting globstar recursion
Record
CLSA-2026-1776782592
Updated
2026-11-02
OSVCLSA-2026-1776783520 No score

nodejs: Fix of 2 CVEs

  • CVE-2026-26996: fix ReDoS in bundled minimatch caused by consecutive non-globstar * characters, by coalescing them during pattern compilation
  • CVE-2026-27904: fix ReDoS in bundled minimatch from nested extglobs and multiple non-adjacent ** wildcards, by limiting globstar recursion
Record
CLSA-2026-1776783520
Updated
2026-11-02
OSVCLSA-2026-1776904631 No score

TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 1.0.0-tuxcare.2.

Record
CLSA-2026-1776904631
Updated
2026-11-02
OSVCLSA-2026-1779065203 No score

TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 3.0.5-tuxcare.1.

Record
CLSA-2026-1779065203
Updated
2026-11-05
OSVCLSA-2026-1784596320 No score

TuxCare security update for minimatch (3 CVEs)

TuxCare rebuilt minimatch to address 3 CVEs. Fixed in 9.0.3-tuxcare.1.

Record
CLSA-2026-1784596320
Updated
2026-11-02
OSVCLSA-2026-1786361581 No score

TuxCare security update for jsonwebtoken (2 CVEs)

TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.3.0-tuxcare.2.

Record
CLSA-2026-1786361581
Updated
2026-11-02
OSVCLSA-2026-1786361876 No score

TuxCare security update for minimatch (4 CVEs)

TuxCare rebuilt minimatch to address 4 CVEs. Fixed in 0.2.5-tuxcare.1.

Record
CLSA-2026-1786361876
Updated
2026-11-05
OSVCLSA-2026-1787004422 No score

TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.2.14-tuxcare.3.

Record
CLSA-2026-1787004422
Updated
2026-11-02
OSVCLSA-2026-1787072761 No score

TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.0.4-tuxcare.3.

Record
CLSA-2026-1787072761
Updated
2026-11-05
OSVCLSA-2026-1790604963 No score

TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 7.4.6-tuxcare.1.

Record
CLSA-2026-1790604963
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
minimatch
npm
 10.0.0 up to 10.2.1
10.2.1
minimatch
npm
 9.0.0 up to 9.0.6
9.0.6
minimatch
npm
 8.0.0 up to 8.0.5
8.0.5
minimatch
npm
 7.0.0 up to 7.4.7
7.4.7
minimatch
npm
 6.0.0 up to 6.2.1
6.2.1
minimatch
npm
 5.0.0 up to 5.1.7
5.1.7
minimatch
npm
 4.0.0 up to 4.2.4
4.2.4
minimatch
npm
 before 3.1.3
3.1.3
nodejs-docs
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
Show 290 moreShow less
Affected packages
PackageAffectedFixed
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-libs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3.0.1-1.module_el8.10.0+4006+3c416519
3.0.1-1.module_el8.10.0+4006+3c416519
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
v8-12.4-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
nodejs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-docs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-libs
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:24.14.1-2.module_el9.7.0+222+ef1c61e1
1:24.14.1-2.module_el9.7.0+222+ef1c61e1
nodejs-nodemon
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3.0.3-3.module_el9.7.0+209+ecf6523e
3.0.3-3.module_el9.7.0+209+ecf6523e
nodejs-packaging
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 18 CVEs
 before 2021.06-6.module_el9.7.0+198+8bf605ba
2021.06-6.module_el9.7.0+198+8bf605ba
npm
AlmaLinux:9
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
v8-13.6-devel
AlmaLinux:9
From an advisory covering 18 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1
nodejs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-docs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-libs
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:24.14.1-2.module_el8.10.0+4160+4819ac42
1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-nodemon
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3.0.3-1.module_el8.10.0+4061+f8ceeab9
3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 17 CVEs
 before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 17 CVEs
 before 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
v8-13.6-devel
AlmaLinux:8
From an advisory covering 17 CVEs
 before 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
nodejs24-docs
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs24-npm
AlmaLinux:10
From an advisory covering 18 CVEs
 before 1:11.11.0-1.24.14.1.2.el10_1
1:11.11.0-1.24.14.1.2.el10_1
nodejs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-docs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-nodemon
AlmaLinux:9
From an advisory covering 4 CVEs
 before 3.0.1-1.module_el9.5.0+125+8dc38870
3.0.1-1.module_el9.5.0+125+8dc38870
nodejs-packaging
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2021.06-6.module_el9.7.0+226+88d36870
2021.06-6.module_el9.7.0+226+88d36870
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2021.06-6.module_el9.7.0+226+88d36870
2021.06-6.module_el9.7.0+226+88d36870
npm
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b
1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b
npm
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870
1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870
nodejs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-docs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-nodemon
AlmaLinux:8
From an advisory covering 4 CVEs
 before 3.0.1-1.module_el8.10.0+3982+85c136aa
3.0.1-1.module_el8.10.0+3982+85c136aa
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2021.06-6.module_el8.10.0+4165+3f200bda
2021.06-6.module_el8.10.0+4165+3f200bda
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2021.06-6.module_el8.10.0+4165+3f200bda
2021.06-6.module_el8.10.0+4165+3f200bda
npm
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
minimatch
TuxCare:npm
 3.1.2-tuxcare.0 up to 3.1.2-tuxcare.1, plus listed versions
3.1.2
3.1.2-tuxcare.1
minimatch
TuxCare:npm
 5.1.0-tuxcare.0 up to 5.1.0-tuxcare.3, plus listed versions
5.1.05.1.0-tuxcare.15.1.0-tuxcare.2
5.1.0-tuxcare.3
minimatch
TuxCare:npm
 3.0.4-tuxcare.0 up to 3.0.4-tuxcare.3, plus listed versions
3.0.43.0.4-tuxcare.13.0.4-tuxcare.2
3.0.4-tuxcare.3
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 3.1.5-tuxcare.0 up to 3.1.5-tuxcare.1, plus listed versions
3.1.5
3.1.5-tuxcare.1
nodejs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
nodejs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
nodejs-docs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
nodejs-full-i18n
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
nodejs-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
npm
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els11
1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els11
v8-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els11
2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els11
nodejs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
nodejs-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
nodejs-docs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
nodejs-full-i18n
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
nodejs-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
npm
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els11
1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els11
v8-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els11
2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els11
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 1.0.0-tuxcare.0 up to 1.0.0-tuxcare.2, plus listed versions
1.0.01.0.0-tuxcare.1
1.0.0-tuxcare.2
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 3.0.5-tuxcare.0 up to 3.0.5-tuxcare.1, plus listed versions
3.0.5
3.0.5-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 3 CVEs
 9.0.3-tuxcare.0 up to 9.0.3-tuxcare.1, plus listed versions
9.0.3
9.0.3-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 4 CVEs
 0.2.5-tuxcare.0 up to 0.2.5-tuxcare.1, plus listed versions
0.2.5
0.2.5-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 0.2.14-tuxcare.0 up to 0.2.14-tuxcare.3, plus listed versions
0.2.140.2.14-tuxcare.10.2.14-tuxcare.2
0.2.14-tuxcare.3
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 0.0.4-tuxcare.0 up to 0.0.4-tuxcare.3, plus listed versions
0.0.40.0.4-tuxcare.10.0.4-tuxcare.2
0.0.4-tuxcare.3
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 7.4.6-tuxcare.0 up to 7.4.6-tuxcare.1, plus listed versions
7.4.6
7.4.6-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 0.4.0-tuxcare.0 up to 0.4.0-tuxcare.2, plus listed versions
0.4.00.4.0-tuxcare.1
0.4.0-tuxcare.2
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 10.1.1-tuxcare.0 up to 10.1.1-tuxcare.1, plus listed versions
10.1.1
10.1.1-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 3 CVEs
 9.0.5-tuxcare.0 up to 9.0.5-tuxcare.1, plus listed versions
9.0.5
9.0.5-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 5.1.1-tuxcare.0 up to 5.1.1-tuxcare.1, plus listed versions
5.1.1
5.1.1-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 3 CVEs
 3.0.3-tuxcare.0 up to 3.0.3-tuxcare.1, plus listed versions
3.0.3
3.0.3-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 5.1.2-tuxcare.0 up to 5.1.2-tuxcare.1, plus listed versions
5.1.2
5.1.2-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 4.2.3-tuxcare.0 up to 4.2.3-tuxcare.1, plus listed versions
4.2.3
4.2.3-tuxcare.1
minimatch
TuxCare:npm
From an advisory covering 3 CVEs
 5.1.6-tuxcare.0 up to 5.1.6-tuxcare.1, plus listed versions
5.1.6
5.1.6-tuxcare.1
node-minimatch
Debian:12
 All versions, plus listed versions
5.1.1+~5.1.2-19.0.3-19.0.3-29.0.3-39.0.3-4
Show 4 moreShow less
9.0.3-59.0.3-69.0.7-19.0.7-2
 None known
node-minimatch
Debian:13
 All versions, plus listed versions
9.0.3-69.0.7-19.0.7-2
 None known
node-minimatch
Debian:14
 before 9.0.7-1, plus listed versions
9.0.3-6
9.0.7-1
automation-controller
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
python3.12-markdown
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:3.10.2-1.el9ap
0:3.10.2-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+activitystream
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+api_documentation
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+authentication
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+channel_auth
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+feature_flags
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+jwt_consumer
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+oauth2_provider
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+rbac
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+redis_client
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+resource_registry
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+rest_filters
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-pyasn1
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:0.6.3-1.el9ap
0:0.6.3-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.4-3.el10ap
0:1.6.4-3.el10ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.4-3.el10ap
0:1.6.4-3.el10ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.4-3.el10ap
0:1.6.4-3.el10ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.4-3.el10ap
0:1.6.4-3.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-2.el9
0:2.6.14-2.el9
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-2.el9
0:2.6.14-2.el9
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-2.el9
0:2.6.14-2.el9
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.8-1.el9ap
0:2.6.8-1.el9ap
python3.12-pyOpenSSL
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:26.0.0-1.el9ap
0:26.0.0-1.el9ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.12.1-1.el9ap
0:2.12.1-1.el9ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.12.1-1.el9ap
0:2.12.1-1.el9ap
python3.12-jwcrypto
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.5.7-1.el9ap
0:1.5.7-1.el9ap
eap8-bouncycastle
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-jmail
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-pg
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-pkix
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-prov
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-util
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-angus
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el8eap
0:2.0.5-1.redhat_00001.1.el8eap
eap8-angus-activation
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.3-1.redhat_00001.1.el8eap
0:2.0.3-1.redhat_00001.1.el8eap
eap8-angus-mail
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el8eap
0:2.0.5-1.redhat_00001.1.el8eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el8eap
0:801.6.0-1.GA_redhat_00001.1.el8eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el8eap
0:801.6.0-1.GA_redhat_00001.1.el8eap
eap8-guava
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el8eap
0:33.0.0-3.jre_redhat_00004.1.el8eap
eap8-guava-failureaccess
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.0.3-1.redhat_00001.1.el8eap
0:1.0.3-1.redhat_00001.1.el8eap
eap8-guava-libraries
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el8eap
0:33.0.0-3.jre_redhat_00004.1.el8eap
eap8-hal-console
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.7.19-1.Final_redhat_00001.1.el8eap
0:3.7.19-1.Final_redhat_00001.1.el8eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-backend-elasticsearch
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-backend-lucene
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-engine
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-mapper-orm
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-mapper-pojo-base
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-util-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-jakarta-activation
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.redhat_00001.1.el8eap
0:2.1.4-1.redhat_00001.1.el8eap
eap8-jboss-logging
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.6.2-1.Final_redhat_00001.1.el8eap
0:3.6.2-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-appclient
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-ear
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-ejb
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-web
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jctools
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el8eap
0:4.0.6-1.redhat_00001.1.el8eap
eap8-jctools-core
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el8eap
0:4.0.6-1.redhat_00001.1.el8eap
eap8-netty
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-buffer
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
nodejs22
Rocky Linux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 18 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:3.0.3-1.module+el8.10.0+2084+ab509703
0:3.0.3-1.module+el8.10.0+2084+ab509703
nodejs-packaging
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs24
Rocky Linux:10
From an advisory covering 18 CVEs
 before 1:24.14.1-2.el10_1
1:24.14.1-2.el10_1
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-packaging
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-packaging
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
minimatch
Root:npm
 before 10.1.1-aikido.3
10.1.1-aikido.310.1.2-aikido.43.0.5-aikido.23.0.8-aikido.29.0.0-aikido.43.1.2-aikido.49.0.4-aikido.310.0.1-aikido.48.0.4-aikido.25.1.0-aikido.49.0.5-aikido.410.0.3-aikido.49.0.3-aikido.48.0.4-aikido.35.1.6-aikido.49.0.4-aikido.43.0.8-aikido.33.0.4-aikido.24.2.1-aikido.14.2.3-aikido.17.4.6-aikido.29.0.6-aikido.2
@rootio/minimatch
Root:npm
 before 9.0.5-root.io.1
9.0.5-root.io.110.1.1-root.io.19.0.3-root.io.13.1.2-root.io.19.0.4-root.io.110.0.3-root.io.110.0.1-root.io.19.0.0-root.io.19.0.5-root.io.23.1.2-root.io.29.0.5-root.io.35.1.6-root.io.110.0.3-root.io.23.1.2-root.io.310.0.1-root.io.25.1.6-root.io.29.0.3-root.io.25.1.6-root.io.310.0.1-root.io.39.0.3-root.io.310.0.3-root.io.310.1.2-root.io.210.1.2-root.io.39.0.0-root.io.29.0.0-root.io.39.0.4-root.io.210.1.1-root.io.310.1.2-root.io.43.0.5-root.io.23.0.8-root.io.29.0.0-root.io.43.1.2-root.io.49.0.4-root.io.310.0.1-root.io.48.0.4-root.io.18.0.4-root.io.29.0.5-root.io.45.1.0-root.io.410.1.1-root.io.210.0.3-root.io.43.0.5-root.io.19.0.3-root.io.43.0.8-root.io.18.0.4-root.io.35.1.6-root.io.49.0.4-root.io.43.0.8-root.io.33.0.4-root.io.24.2.1-root.io.14.2.3-root.io.17.4.6-root.io.29.0.6-root.io.29.0.6-root.io.1
cockpit
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 2 CVEs
 before 251.3-150300.6.9.1
251.3-150300.6.9.1
cockpit-machines
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 2 CVEs
 before 249.1-150300.5.6.1
249.1-150300.5.6.1
cockpit-tukit
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 2 CVEs
 before 0.0.3~git14.ff11a9a-150300.1.9.1
0.0.3~git14.ff11a9a-150300.1.9.1
cockpit-podman
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 2 CVEs
 before 33-150300.6.9.1
33-150300.6.9.1
cockpit-repos
SUSE:Linux Micro 6.2
 before 4.7-160000.2.1
4.7-160000.2.1
cockpit-repos
SUSE:Linux Enterprise Server 16.0
 before 4.7-160000.2.1
4.7-160000.2.1
cockpit-repos
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 4.7-160000.2.1
4.7-160000.2.1
cockpit
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 354-160000.2.1
354-160000.2.1
cockpit-podman
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 117-160000.2.1
117-160000.2.1
cockpit-machines
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 346-160000.2.1
346-160000.2.1
cockpit-subscriptions
SUSE:Linux Micro 6.2
 before 12.1-160000.3.1
12.1-160000.3.1
cockpit-packages
SUSE:Linux Enterprise Server 16.0
 before 4-160000.1.1
4-160000.1.1
cockpit-packages
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 4-160000.1.1
4-160000.1.1
cockpit
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 354-160000.2.1
354-160000.2.1
cockpit
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 354-160000.2.1
354-160000.2.1
cockpit-podman
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 117-160000.2.1
117-160000.2.1
cockpit-podman
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 117-160000.2.1
117-160000.2.1
cockpit-machines
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 346-160000.2.1
346-160000.2.1
cockpit-machines
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 346-160000.2.1
346-160000.2.1
cockpit-subscriptions
SUSE:Linux Enterprise Server 16.0
 before 12.1-160000.3.1
12.1-160000.3.1
cockpit-subscriptions
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 12.1-160000.3.1
12.1-160000.3.1
kernel-rt
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 6.4.0-41.1
6.4.0-41.1
kernel-source-rt
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 6.4.0-41.1
6.4.0-41.1
cockpit
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 322-slfo.1.1_3.1
322-slfo.1.1_3.1
cockpit-tukit
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 0.1.2~git0.647b3e3-2.1
0.1.2~git0.647b3e3-2.1
cockpit-machines
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 305-4.1
305-4.1
cockpit-machines
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 316-slfo.1.1_3.1
316-slfo.1.1_3.1
cockpit-podman
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 91-slfo.1.1_4.1
91-slfo.1.1_4.1
cockpit
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 364-160000.1.1
364-160000.1.1
cockpit-machines
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 354-160000.1.1
354-160000.1.1
cockpit-podman
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 128-160000.1.1
128-160000.1.1
cockpit-repos
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 4.8-160000.1.1
4.8-160000.1.1
cockpit-subscriptions
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 16.2-160000.1.1
16.2-160000.1.1
cockpit
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 364-160000.1.1
364-160000.1.1
cockpit-machines
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 354-160000.1.1
354-160000.1.1
cockpit-packages
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 5-160000.1.1
5-160000.1.1
cockpit-podman
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 128-160000.1.1
128-160000.1.1
cockpit-repos
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 4.8-160000.1.1
4.8-160000.1.1
cockpit-subscriptions
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 16.2-160000.1.1
16.2-160000.1.1
cockpit
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 364-160000.1.1
364-160000.1.1
cockpit-machines
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 354-160000.1.1
354-160000.1.1
cockpit-packages
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 5-160000.1.1
5-160000.1.1
cockpit-podman
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 128-160000.1.1
128-160000.1.1
cockpit-repos
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 4.8-160000.1.1
4.8-160000.1.1
cockpit-subscriptions
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 16.2-160000.1.1
16.2-160000.1.1
node-minimatch
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.2.11-10.2.12-10.2.12-1ubuntu0.1~esm2
 None known
node-minimatch
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.0.0-11.0.0-1ubuntu0.1~esm2
 None known
node-minimatch
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.0.4-13.0.4-33.0.4-3+deb10u1build0.18.04.1
 None known
node-minimatch
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.0.4-33.0.4-43.0.4-4ubuntu0.1
 None known
node-minimatch
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.0.4+~3.0.3-13.0.4+~3.0.5-13.1.1+~3.0.5-1
 None known
node-minimatch
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.1.1+~5.1.2-19.0.3-4build5
 None known
node-minimatch
Ubuntu:25.10
 All versions, plus listed versions
9.0.3-59.0.3-6
 None known
node-minimatch
Ubuntu:26.10
 All versions, plus listed versions
9.0.3-69.0.7-1
 None known
node-minimatch
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.0.3-6
 None known
velociraptor
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1
openQA
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 5.1782995932.ffeb09be-1.1
5.1782995932.ffeb09be-1.1
cockpit-repos
openSUSE:Leap 16.0
 before 4.7-160000.2.1
4.7-160000.2.1
cockpit-packages
openSUSE:Leap 16.0
 before 4-160000.1.1
4-160000.1.1
cockpit-podman
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 117-160000.2.1
117-160000.2.1
cockpit-machines
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 346-160000.2.1
346-160000.2.1
cockpit
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 354-160000.2.1
354-160000.2.1
cockpit-subscriptions
openSUSE:Leap 16.0
 before 12.1-160000.3.1
12.1-160000.3.1
openQA
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 5.1783076943.6691832d-bp160.1.1
5.1783076943.6691832d-bp160.1.1
os-autoinst
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 5.1783082953.c3cb41d-bp160.1.1
5.1783082953.c3cb41d-bp160.1.1
cockpit
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 364-160000.1.1
364-160000.1.1
cockpit-machines
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 354-160000.1.1
354-160000.1.1
cockpit-packages
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 5-160000.1.1
5-160000.1.1
cockpit-podman
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 128-160000.1.1
128-160000.1.1
cockpit-repos
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 4.8-160000.1.1
4.8-160000.1.1
cockpit-subscriptions
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 16.2-160000.1.1
16.2-160000.1.1

History

History
RecordedChangedSources
affected, aliasesOSV
affected
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-26996 is a high vulnerability (CVSS 8.7) in Isaacs Minimatch, published February 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in minimatch 10.2.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 276 package rows and 344 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 42 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open