Every CVE Search/ Get API key

CVE-2026-27904

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

7.5 HighFix available

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.53%Up 0.5 points since Feb 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Record
CVE-2026-27904
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2026-8802 7.5

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Record
EUVD-2026-8802
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-23c5-xmqv-rm74 7.5

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Summary

Nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally.

Details

The root cause is in AST.toRegExpSource() at src/ast.ts#L598. For the * extglob type, the close token emitted is )* or )?, wrapping the recursive body in (?:...)*. When extglobs are nested, each level adds another * quantifier around the previous group:

: this.type === '*' && bodyDotAllowed ? `)?`
: `)${this.type}`

This produces the following regexps:

| Pattern | Generated regex | |----------------------|------------------------------------------| | *(a\|b) | /^(?:a\|b)*$/ | | *(*(a\|b)) | /^(?:(?:a\|b)*)*$/ | | *(*(*(a\|b))) | /^(?:(?:(?:a\|b)*)*)*$/ | | *(*(*(*(a\|b)))) | /^(?:(?:(?:(?:a\|b)*)*)*)*$/ |

These are textbook nested-quantifier patterns. Against an input of repeated a characters followed by a non-matching character z, V8's backtracking engine explores an exponential number of paths before returning false.

The generated regex is stored on this.set and evaluated inside matchOne() at src/index.ts#L1010 via p.test(f). It is reached through the standard minimatch() call with no configuration.

Measured times via minimatch():

| Pattern | Input | Time | |----------------------|--------------------|------------| | *(*(a\|b)) | a x30 + z | ~68,000ms | | *(*(*(a\|b))) | a x20 + z | ~124,000ms | | *(*(*(*(a\|b)))) | a x25 + z | ~116,000ms | | *(a\|a) | a x25 + z | ~2,000ms |

Depth inflection at fixed input a x16 + z:

| Depth | Pattern | Time | |-------|----------------------|--------------| | 1 | *(a\|b) | 0ms | | 2 | *(*(a\|b)) | 4ms | | 3 | *(*(*(a\|b))) | 270ms | | 4 | *(*(*(*(a\|b)))) | 115,000ms |

Going from depth 2 to depth 3 with a 20-character input jumps from 66ms to 123,544ms -- a 1,867x increase from a single added nesting level.

PoC

Tested on [email protected], Node.js 20.

Step 1 -- verify the generated regexps and timing (standalone script)

Save as poc4-validate.mjs and run with node poc4-validate.mjs:

import { minimatch, Minimatch } from 'minimatch'

function timed(fn) {
  const s = process.hrtime.bigint()
  let result, error
  try { result = fn() } catch(e) { error = e }
  const ms = Number(process.hrtime.bigint() - s) / 1e6
  return { ms, result, error }
}

// Verify generated regexps
for (let depth = 1; depth <= 4; depth++) {
  let pat = 'a|b'
  for (let i = 0; i < depth; i++) pat = `*(${pat})`
  const re = new Minimatch(pat, {}).set?.[0]?.[0]?.toString()
  console.log(`depth=${depth} "${pat}" -> ${re}`)
}
// depth=1 "*(a|b)"          -> /^(?:a|b)*$/
// depth=2 "*(*(a|b))"       -> /^(?:(?:a|b)*)*$/
// depth=3 "*(*(*(a|b)))"    -> /^(?:(?:(?:a|b)*)*)*$/
// depth=4 "*(*(*(*(a|b))))" -> /^(?:(?:(?:(?:a|b)*)*)*)*$/

// Safe-length timing (exponential growth confirmation without multi-minute hang)
const cases = [
  ['*(*(*(a|b)))', 15],   // ~270ms
  ['*(*(*(a|b)))', 17],   // ~800ms
  ['*(*(*(a|b)))', 19],   // ~2400ms
  ['*(*(a|b))',    23],   // ~260ms
  ['*(a|b)',      101],…
Record
GHSA-23c5-xmqv-rm74
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
NVD 7.5

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Record
CVE-2026-27904
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSV 7.5

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Record
CVE-2026-27904
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVDEBIAN-CVE-2026-27904 7.5

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Record
DEBIAN-CVE-2026-27904
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSVGHSA-23c5-xmqv-rm74 7.5

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Summary

Nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally.

Details

The root cause is in AST.toRegExpSource() at src/ast.ts#L598. For the * extglob type, the close token emitted is )* or )?, wrapping the recursive body in (?:...)*. When extglobs are nested, each level adds another * quantifier around the previous group:

: this.type === '*' && bodyDotAllowed ? `)?`
: `)${this.type}`

This produces the following regexps:

| Pattern | Generated regex | |----------------------|------------------------------------------| | *(a\|b) | /^(?:a\|b)*$/ | | *(*(a\|b)) | /^(?:(?:a\|b)*)*$/ | | *(*(*(a\|b))) | /^(?:(?:(?:a\|b)*)*)*$/ | | *(*(*(*(a\|b)))) | /^(?:(?:(?:(?:a\|b)*)*)*)*$/ |

These are textbook nested-quantifier patterns. Against an input of repeated a characters followed by a non-matching character z, V8's backtracking engine explores an exponential number of paths before returning false.

The generated regex is stored on this.set and evaluated inside matchOne() at src/index.ts#L1010 via p.test(f). It is reached through the standard minimatch() call with no configuration.

Measured times via minimatch():

| Pattern | Input | Time | |----------------------|--------------------|------------| | *(*(a\|b)) | a x30 + z | ~68,000ms | | *(*(*(a\|b))) | a x20 + z | ~124,000ms | | *(*(*(*(a\|b)))) | a x25 + z | ~116,000ms | | *(a\|a) | a x25 + z | ~2,000ms |

Depth inflection at fixed input a x16 + z:

| Depth | Pattern | Time | |-------|----------------------|--------------| | 1 | *(a\|b) | 0ms | | 2 | *(*(a\|b)) | 4ms | | 3 | *(*(*(a\|b))) | 270ms | | 4 | *(*(*(*(a\|b)))) | 115,000ms |

Going from depth 2 to depth 3 with a 20-character input jumps from 66ms to 123,544ms -- a 1,867x increase from a single added nesting level.

PoC

Tested on [email protected], Node.js 20.

Step 1 -- verify the generated regexps and timing (standalone script)

Save as poc4-validate.mjs and run with node poc4-validate.mjs:

import { minimatch, Minimatch } from 'minimatch'

function timed(fn) {
  const s = process.hrtime.bigint()
  let result, error
  try { result = fn() } catch(e) { error = e }
  const ms = Number(process.hrtime.bigint() - s) / 1e6
  return { ms, result, error }
}

// Verify generated regexps
for (let depth = 1; depth <= 4; depth++) {
  let pat = 'a|b'
  for (let i = 0; i < depth; i++) pat = `*(${pat})`
  const re = new Minimatch(pat, {}).set?.[0]?.[0]?.toString()
  console.log(`depth=${depth} "${pat}" -> ${re}`)
}
// depth=1 "*(a|b)"          -> /^(?:a|b)*$/
// depth=2 "*(*(a|b))"       -> /^(?:(?:a|b)*)*$/
// depth=3 "*(*(*(a|b)))"    -> /^(?:(?:(?:a|b)*)*)*$/
// depth=4 "*(*(*(*(a|b))))" -> /^(?:(?:(?:(?:a|b)*)*)*)*$/

// Safe-length timing (exponential growth confirmation without multi-minute hang)
const cases = [
  ['*(*(*(a|b)))', 15],   // ~270ms
  ['*(*(*(a|b)))', 17],   // ~800ms
  ['*(*(*(a|b)))', 19],   // ~2400ms
  ['*(*(a|b))',    23],   // ~260ms
  ['*(a|b)',      101],…
Record
GHSA-23c5-xmqv-rm74
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVRHSA-2026:18054 9.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Record
RHSA-2026:18054
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:18055 9.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Record
RHSA-2026:18055
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:24761 7.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:24761
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:6277 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:6277
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7080 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7123 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7302 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7310 7.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:7310
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7896 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:7896
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7983 7.5

Red Hat Security Advisory: nodejs:22 security update

Record
RHSA-2026:7983
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8339 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:8339
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:9711 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:9711
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:9874 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2026:9874
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7080 7.5

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7123 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7123
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7302 7.5

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:7896 7.5

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:7896
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:8339 7.5

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:8339
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-27904 7.5

CVE-2026-27904 in minimatch - Patched by Root

Root has patched CVE-2026-27904 in the minimatch package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-27904
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-27904 7.5

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested *() extglobs produce regexps with nested unbounded quantifiers (e.g. (?:(?:a|b)*)*), which exhibit catastrophic backtracking in V8. With a 12-byte pattern *(*(*(a|b))) and an 18-byte non-matching input, minimatch() stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default minimatch() API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects +() extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

Record
UBUNTU-CVE-2026-27904
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:7080 No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7080
Updated
2026-11-02
OSVALSA-2026:7123 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
  • undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
  • undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
  • undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7123
Updated
2026-11-02
OSVALSA-2026:7896 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:7896
Updated
2026-11-02
OSVALSA-2026:8339 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
  • minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
  • Node.js: Node.js: Denial of Service due to crafted HTTP __proto__ header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:8339
Updated
2026-11-02
OSVCLSA-2026-1776782592 No score

nodejs: Fix of 2 CVEs

  • CVE-2026-26996: fix ReDoS in bundled minimatch caused by consecutive non-globstar * characters, by coalescing them during pattern compilation
  • CVE-2026-27904: fix ReDoS in bundled minimatch from nested extglobs and multiple non-adjacent ** wildcards, by limiting globstar recursion
Record
CLSA-2026-1776782592
Updated
2026-11-02
OSVCLSA-2026-1776783520 No score

nodejs: Fix of 2 CVEs

  • CVE-2026-26996: fix ReDoS in bundled minimatch caused by consecutive non-globstar * characters, by coalescing them during pattern compilation
  • CVE-2026-27904: fix ReDoS in bundled minimatch from nested extglobs and multiple non-adjacent ** wildcards, by limiting globstar recursion
Record
CLSA-2026-1776783520
Updated
2026-11-02
OSVCLSA-2026-1784596320 No score

TuxCare security update for minimatch (3 CVEs)

TuxCare rebuilt minimatch to address 3 CVEs. Fixed in 9.0.3-tuxcare.1.

Record
CLSA-2026-1784596320
Updated
2026-11-02
OSVCLSA-2026-1791289858 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.4.0-tuxcare.3.

Record
CLSA-2026-1791289858
Updated
2026-11-02
OSVCLSA-2026-1791292466 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 7.4.6-tuxcare.2.

Record
CLSA-2026-1791292466
Updated
2026-11-02
OSVCLSA-2026-1791458597 No score

TuxCare security update for minimatch (3 CVEs)

TuxCare rebuilt minimatch to address 3 CVEs. Fixed in 9.0.5-tuxcare.1.

Record
CLSA-2026-1791458597
Updated
2026-11-02
OSVCLSA-2026-1792254949 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 10.1.1-tuxcare.2.

Record
CLSA-2026-1792254949
Updated
2026-11-02
OSVCLSA-2026-1792369174 No score

TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 10.2.2-tuxcare.1.

Record
CLSA-2026-1792369174
Updated
2026-11-02
OSVCLSA-2026-1792764805 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.0.3-tuxcare.2.

Record
CLSA-2026-1792764805
Updated
2026-11-02
OSVCLSA-2026-1792809973 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 4.2.3-tuxcare.2.

Record
CLSA-2026-1792809973
Updated
2026-11-02
OSVCLSA-2026-1793867543 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.0.4-tuxcare.8.

Record
CLSA-2026-1793867543
Updated
2026-11-05
OSVCLSA-2026-1793877387 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 5.1.9-tuxcare.1.

Record
CLSA-2026-1793877387
Updated
2026-11-05
OSVCLSA-2026-1793877953 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.0.4-tuxcare.4.

Record
CLSA-2026-1793877953
Updated
2026-11-05
OSVCLSA-2026-1793877955 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.0.5-tuxcare.3.

Record
CLSA-2026-1793877955
Updated
2026-11-05
OSVCLSA-2026-1793877958 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.2.14-tuxcare.6.

Record
CLSA-2026-1793877958
Updated
2026-11-05
OSVCLSA-2026-1793877960 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.2.5-tuxcare.3.

Record
CLSA-2026-1793877960
Updated
2026-11-05
OSVCLSA-2026-1793877962 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.3.0-tuxcare.6.

Record
CLSA-2026-1793877962
Updated
2026-11-05
OSVCLSA-2026-1793877964 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.4.0-tuxcare.4.

Record
CLSA-2026-1793877964
Updated
2026-11-05
OSVCLSA-2026-1793877967 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 1.0.0-tuxcare.5.

Record
CLSA-2026-1793877967
Updated
2026-11-05
OSVCLSA-2026-1793877969 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 2.0.10-tuxcare.5.

Record
CLSA-2026-1793877969
Updated
2026-11-05
OSVCLSA-2026-1793877971 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.0.3-tuxcare.4.

Record
CLSA-2026-1793877971
Updated
2026-11-05
OSVCLSA-2026-1793877973 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.0.5-tuxcare.4.

Record
CLSA-2026-1793877973
Updated
2026-11-05
OSVCLSA-2026-1793877975 No score

TuxCare security update for minimatch (1 CVE)

TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.1.2-tuxcare.9.

Record
CLSA-2026-1793877975
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
minimatch
npm
 10.0.0 up to 10.2.3
10.2.3
minimatch
npm
 9.0.0 up to 9.0.7
9.0.7
minimatch
npm
 8.0.0 up to 8.0.6
8.0.6
minimatch
npm
 7.0.0 up to 7.4.8
7.4.8
minimatch
npm
 6.0.0 up to 6.2.2
6.2.2
minimatch
npm
 5.0.0 up to 5.1.8
5.1.8
minimatch
npm
 4.0.0 up to 4.2.5
4.2.5
minimatch
npm
 before 3.1.4
3.1.4
nodejs-docs
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
Show 290 moreShow less
Affected packages
PackageAffectedFixed
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-libs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:22.22.2-1.module_el8.10.0+4158+e796f37f
1:22.22.2-1.module_el8.10.0+4158+e796f37f
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3.0.1-1.module_el8.10.0+4006+3c416519
3.0.1-1.module_el8.10.0+4006+3c416519
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f
v8-12.4-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f
nodejs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-docs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+224+0af7cc6b
1:20.20.2-1.module_el9.7.0+224+0af7cc6b
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el9.7.0+226+88d36870
1:20.20.2-1.module_el9.7.0+226+88d36870
nodejs-nodemon
AlmaLinux:9
From an advisory covering 4 CVEs
 before 3.0.1-1.module_el9.5.0+125+8dc38870
3.0.1-1.module_el9.5.0+125+8dc38870
nodejs-packaging
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2021.06-6.module_el9.7.0+226+88d36870
2021.06-6.module_el9.7.0+226+88d36870
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2021.06-6.module_el9.7.0+226+88d36870
2021.06-6.module_el9.7.0+226+88d36870
npm
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b
1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b
npm
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870
1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870
nodejs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-docs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:20.20.2-1.module_el8.10.0+4165+3f200bda
1:20.20.2-1.module_el8.10.0+4165+3f200bda
nodejs-nodemon
AlmaLinux:8
From an advisory covering 4 CVEs
 before 3.0.1-1.module_el8.10.0+3982+85c136aa
3.0.1-1.module_el8.10.0+3982+85c136aa
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2021.06-6.module_el8.10.0+4165+3f200bda
2021.06-6.module_el8.10.0+4165+3f200bda
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2021.06-6.module_el8.10.0+4165+3f200bda
2021.06-6.module_el8.10.0+4165+3f200bda
npm
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
nodejs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
nodejs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
nodejs-docs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
nodejs-full-i18n
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
nodejs-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_2.tuxcare.els11
1:16.20.2-8.el9_2.tuxcare.els11
npm
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els11
1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els11
v8-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els11
2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els11
nodejs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
nodejs-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
nodejs-docs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
nodejs-full-i18n
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
nodejs-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els11
1:16.20.2-8.el9_6.tuxcare.els11
npm
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els11
1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els11
v8-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els11
2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els11
minimatch
TuxCare:npm
From an advisory covering 3 CVEs
 9.0.3-tuxcare.0 up to 9.0.3-tuxcare.1, plus listed versions
9.0.3
9.0.3-tuxcare.1
minimatch
TuxCare:npm
 0.4.0-tuxcare.0 up to 0.4.0-tuxcare.3, plus listed versions
0.4.00.4.0-tuxcare.10.4.0-tuxcare.2
0.4.0-tuxcare.3
minimatch
TuxCare:npm
 7.4.6-tuxcare.0 up to 7.4.6-tuxcare.2, plus listed versions
7.4.67.4.6-tuxcare.1
7.4.6-tuxcare.2
minimatch
TuxCare:npm
From an advisory covering 3 CVEs
 9.0.5-tuxcare.0 up to 9.0.5-tuxcare.1, plus listed versions
9.0.5
9.0.5-tuxcare.1
minimatch
TuxCare:npm
 10.1.1-tuxcare.0 up to 10.1.1-tuxcare.2, plus listed versions
10.1.110.1.1-tuxcare.1
10.1.1-tuxcare.2
minimatch
TuxCare:npm
From an advisory covering 2 CVEs
 10.2.2-tuxcare.0 up to 10.2.2-tuxcare.1, plus listed versions
10.2.2
10.2.2-tuxcare.1
minimatch
TuxCare:npm
 3.0.3-tuxcare.0 up to 3.0.3-tuxcare.2, plus listed versions
3.0.33.0.3-tuxcare.1
3.0.3-tuxcare.2
minimatch
TuxCare:npm
 4.2.3-tuxcare.0 up to 4.2.3-tuxcare.2, plus listed versions
4.2.34.2.3-tuxcare.1
4.2.3-tuxcare.2
minimatch
TuxCare:npm
 3.0.4-tuxcare.0 up to 3.0.4-tuxcare.8, plus listed versions
3.0.43.0.4-tuxcare.13.0.4-tuxcare.23.0.4-tuxcare.33.0.4-tuxcare.43.0.4-tuxcare.53.0.4-tuxcare.63.0.4-tuxcare.7
3.0.4-tuxcare.8
minimatch
TuxCare:npm
 5.1.9-tuxcare.0 up to 5.1.9-tuxcare.1, plus listed versions
5.1.9
5.1.9-tuxcare.1
minimatch
TuxCare:npm
 0.0.4-tuxcare.0 up to 0.0.4-tuxcare.4, plus listed versions
0.0.40.0.4-tuxcare.10.0.4-tuxcare.20.0.4-tuxcare.3
0.0.4-tuxcare.4
minimatch
TuxCare:npm
 0.0.5-tuxcare.0 up to 0.0.5-tuxcare.3, plus listed versions
0.0.50.0.5-tuxcare.10.0.5-tuxcare.2
0.0.5-tuxcare.3
minimatch
TuxCare:npm
 0.2.14-tuxcare.0 up to 0.2.14-tuxcare.6, plus listed versions
0.2.140.2.14-tuxcare.10.2.14-tuxcare.20.2.14-tuxcare.30.2.14-tuxcare.40.2.14-tuxcare.5
0.2.14-tuxcare.6
minimatch
TuxCare:npm
 0.2.5-tuxcare.0 up to 0.2.5-tuxcare.3, plus listed versions
0.2.50.2.5-tuxcare.10.2.5-tuxcare.2
0.2.5-tuxcare.3
minimatch
TuxCare:npm
 0.3.0-tuxcare.0 up to 0.3.0-tuxcare.6, plus listed versions
0.3.00.3.0-tuxcare.10.3.0-tuxcare.20.3.0-tuxcare.30.3.0-tuxcare.40.3.0-tuxcare.5
0.3.0-tuxcare.6
minimatch
TuxCare:npm
 0.4.0-tuxcare.0 up to 0.4.0-tuxcare.4, plus listed versions
0.4.00.4.0-tuxcare.10.4.0-tuxcare.20.4.0-tuxcare.3
0.4.0-tuxcare.4
minimatch
TuxCare:npm
 1.0.0-tuxcare.0 up to 1.0.0-tuxcare.5, plus listed versions
1.0.01.0.0-tuxcare.11.0.0-tuxcare.21.0.0-tuxcare.31.0.0-tuxcare.4
1.0.0-tuxcare.5
minimatch
TuxCare:npm
 2.0.10-tuxcare.0 up to 2.0.10-tuxcare.5, plus listed versions
2.0.102.0.10-tuxcare.12.0.10-tuxcare.22.0.10-tuxcare.32.0.10-tuxcare.4
2.0.10-tuxcare.5
minimatch
TuxCare:npm
 3.0.3-tuxcare.0 up to 3.0.3-tuxcare.4, plus listed versions
3.0.33.0.3-tuxcare.13.0.3-tuxcare.23.0.3-tuxcare.3
3.0.3-tuxcare.4
minimatch
TuxCare:npm
 3.0.5-tuxcare.0 up to 3.0.5-tuxcare.4, plus listed versions
3.0.53.0.5-tuxcare.13.0.5-tuxcare.23.0.5-tuxcare.3
3.0.5-tuxcare.4
minimatch
TuxCare:npm
 3.1.2-tuxcare.0 up to 3.1.2-tuxcare.9, plus listed versions
3.1.23.1.2-tuxcare.13.1.2-tuxcare.23.1.2-tuxcare.33.1.2-tuxcare.43.1.2-tuxcare.53.1.2-tuxcare.63.1.2-tuxcare.8
3.1.2-tuxcare.9
minimatch
TuxCare:npm
 3.1.5-tuxcare.0 up to 3.1.5-tuxcare.4, plus listed versions
3.1.53.1.5-tuxcare.13.1.5-tuxcare.23.1.5-tuxcare.3
3.1.5-tuxcare.4
minimatch
TuxCare:npm
 4.2.3-tuxcare.0 up to 4.2.3-tuxcare.4, plus listed versions
4.2.34.2.3-tuxcare.14.2.3-tuxcare.24.2.3-tuxcare.3
4.2.3-tuxcare.4
minimatch
TuxCare:npm
 5.1.0-tuxcare.0 up to 5.1.0-tuxcare.5, plus listed versions
5.1.05.1.0-tuxcare.15.1.0-tuxcare.25.1.0-tuxcare.35.1.0-tuxcare.4
5.1.0-tuxcare.5
minimatch
TuxCare:npm
 5.1.1-tuxcare.0 up to 5.1.1-tuxcare.2, plus listed versions
5.1.15.1.1-tuxcare.1
5.1.1-tuxcare.2
minimatch
TuxCare:npm
 5.1.2-tuxcare.0 up to 5.1.2-tuxcare.2, plus listed versions
5.1.25.1.2-tuxcare.1
5.1.2-tuxcare.2
minimatch
TuxCare:npm
 7.4.6-tuxcare.0 up to 7.4.6-tuxcare.3, plus listed versions
7.4.67.4.6-tuxcare.17.4.6-tuxcare.2
7.4.6-tuxcare.3
minimatch
TuxCare:npm
From an advisory covering 3 CVEs
 5.1.6-tuxcare.0 up to 5.1.6-tuxcare.1, plus listed versions
5.1.6
5.1.6-tuxcare.1
node-minimatch
Debian:12
 All versions, plus listed versions
5.1.1+~5.1.2-19.0.3-19.0.3-29.0.3-39.0.3-4
Show 4 moreShow less
9.0.3-59.0.3-69.0.7-19.0.7-2
 None known
node-minimatch
Debian:13
 All versions, plus listed versions
9.0.3-69.0.7-19.0.7-2
 None known
node-minimatch
Debian:14
 before 9.0.7-1, plus listed versions
9.0.3-6
9.0.7-1
eap8-bouncycastle
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-jmail
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-pg
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-pkix
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-prov
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-bouncycastle-util
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el8eap
0:1.84.0-1.redhat_00001.1.el8eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el8eap
0:8.1.6-5.GA_redhat_00007.1.el8eap
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el8eap
0:2.40.0-6.redhat_00012.1.el8eap
eap8-angus
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el8eap
0:2.0.5-1.redhat_00001.1.el8eap
eap8-angus-activation
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.3-1.redhat_00001.1.el8eap
0:2.0.3-1.redhat_00001.1.el8eap
eap8-angus-mail
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el8eap
0:2.0.5-1.redhat_00001.1.el8eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el8eap
0:801.6.0-1.GA_redhat_00001.1.el8eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el8eap
0:801.6.0-1.GA_redhat_00001.1.el8eap
eap8-guava
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el8eap
0:33.0.0-3.jre_redhat_00004.1.el8eap
eap8-guava-failureaccess
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.0.3-1.redhat_00001.1.el8eap
0:1.0.3-1.redhat_00001.1.el8eap
eap8-guava-libraries
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el8eap
0:33.0.0-3.jre_redhat_00004.1.el8eap
eap8-hal-console
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.7.19-1.Final_redhat_00001.1.el8eap
0:3.7.19-1.Final_redhat_00001.1.el8eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el8eap
0:6.6.48-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-backend-elasticsearch
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-backend-lucene
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-engine
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-mapper-orm
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-mapper-pojo-base
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-hibernate-search-util-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el8eap
0:7.2.6-1.Final_redhat_00001.1.el8eap
eap8-jakarta-activation
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.redhat_00001.1.el8eap
0:2.1.4-1.redhat_00001.1.el8eap
eap8-jboss-logging
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.6.2-1.Final_redhat_00001.1.el8eap
0:3.6.2-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-appclient
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-ear
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-ejb
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jboss-metadata-web
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el8eap
0:16.1.0-1.Final_redhat_00001.1.el8eap
eap8-jctools
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el8eap
0:4.0.6-1.redhat_00001.1.el8eap
eap8-jctools-core
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el8eap
0:4.0.6-1.redhat_00001.1.el8eap
eap8-netty
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-buffer
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-codec
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-codec-dns
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-codec-http
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-codec-socks
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-handler
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-handler-proxy
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-resolver
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-resolver-dns
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport-classes-epoll
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport-native-epoll
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport-native-epoll-debuginfo
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-netty-transport-native-unix-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el8eap
0:4.1.132-1.Final_redhat_00001.1.el8eap
eap8-plexus-utils
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.6.1-1.redhat_00001.1.el8eap
0:3.6.1-1.redhat_00001.1.el8eap
eap8-reactivex-rxjava
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.1.12-1.redhat_00001.1.el8eap
0:3.1.12-1.redhat_00001.1.el8eap
eap8-reactivex-rxjava2
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.2.21-5.redhat_00003.1.el8eap
0:2.2.21-5.redhat_00003.1.el8eap
eap8-wildfly-client-config
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:1.0.1-4.Final_redhat_00002.1.el8eap
0:1.0.1-4.Final_redhat_00002.1.el8eap
eap8-wildfly-http-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-http-client-common
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-http-ejb-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-http-naming-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-http-transaction-client
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.1.4-1.Final_redhat_00001.1.el8eap
0:2.1.4-1.Final_redhat_00001.1.el8eap
eap8-wildfly-javadocs
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:8.1.1-10.GA_redhat_00017.1.el8eap
0:8.1.1-10.GA_redhat_00017.1.el8eap
eap8-wildfly-openssl
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final_redhat_00001.1.el8eap
0:2.3.0-1.Final_redhat_00001.1.el8eap
eap8-wildfly-openssl-el8-x86_64
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final.redhat.00001.1.el8eap
0:2.3.0-1.Final.redhat.00001.1.el8eap
eap8-wildfly-openssl-el8-x86_64-debuginfo
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final.redhat.00001.1.el8eap
0:2.3.0-1.Final.redhat.00001.1.el8eap
eap8-wildfly-openssl-java
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:2.3.0-1.Final_redhat_00001.1.el8eap
0:2.3.0-1.Final_redhat_00001.1.el8eap
eap8-yasson
Red Hat:jboss_enterprise_application_platform:8.1::el8
From an advisory covering 14 CVEs
 before 0:3.0.4-5.redhat_00007.1.el8eap
0:3.0.4-5.redhat_00007.1.el8eap
eap8-bouncycastle
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-jmail
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-pg
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-pkix
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-prov
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-bouncycastle-util
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.84.0-1.redhat_00001.1.el9eap
0:1.84.0-1.redhat_00001.1.el9eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el9eap
0:8.1.6-5.GA_redhat_00007.1.el9eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el9eap
0:8.1.6-5.GA_redhat_00007.1.el9eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el9eap
0:8.1.6-5.GA_redhat_00007.1.el9eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:8.1.6-5.GA_redhat_00007.1.el9eap
0:8.1.6-5.GA_redhat_00007.1.el9eap
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.40.0-6.redhat_00012.1.el9eap
0:2.40.0-6.redhat_00012.1.el9eap
eap8-angus
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el9eap
0:2.0.5-1.redhat_00001.1.el9eap
eap8-angus-activation
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.0.3-1.redhat_00001.1.el9eap
0:2.0.3-1.redhat_00001.1.el9eap
eap8-angus-mail
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.0.5-1.redhat_00001.1.el9eap
0:2.0.5-1.redhat_00001.1.el9eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el9eap
0:801.6.0-1.GA_redhat_00001.1.el9eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:801.6.0-1.GA_redhat_00001.1.el9eap
0:801.6.0-1.GA_redhat_00001.1.el9eap
eap8-guava
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el9eap
0:33.0.0-3.jre_redhat_00004.1.el9eap
eap8-guava-failureaccess
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:1.0.3-1.redhat_00001.1.el9eap
0:1.0.3-1.redhat_00001.1.el9eap
eap8-guava-libraries
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:33.0.0-3.jre_redhat_00004.1.el9eap
0:33.0.0-3.jre_redhat_00004.1.el9eap
eap8-hal-console
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:3.7.19-1.Final_redhat_00001.1.el9eap
0:3.7.19-1.Final_redhat_00001.1.el9eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el9eap
0:6.6.48-1.Final_redhat_00001.1.el9eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el9eap
0:6.6.48-1.Final_redhat_00001.1.el9eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:6.6.48-1.Final_redhat_00001.1.el9eap
0:6.6.48-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-backend-elasticsearch
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-backend-lucene
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-engine
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-mapper-orm
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-mapper-pojo-base
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-hibernate-search-util-common
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:7.2.6-1.Final_redhat_00001.1.el9eap
0:7.2.6-1.Final_redhat_00001.1.el9eap
eap8-jakarta-activation
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:2.1.4-1.redhat_00001.1.el9eap
0:2.1.4-1.redhat_00001.1.el9eap
eap8-jboss-logging
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:3.6.2-1.Final_redhat_00001.1.el9eap
0:3.6.2-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-appclient
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-common
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-ear
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-ejb
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jboss-metadata-web
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:16.1.0-1.Final_redhat_00001.1.el9eap
0:16.1.0-1.Final_redhat_00001.1.el9eap
eap8-jctools
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el9eap
0:4.0.6-1.redhat_00001.1.el9eap
eap8-jctools-core
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.0.6-1.redhat_00001.1.el9eap
0:4.0.6-1.redhat_00001.1.el9eap
eap8-netty
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-buffer
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-codec
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-codec-dns
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-codec-http
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-codec-socks
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
eap8-netty-common
Red Hat:jboss_enterprise_application_platform:8.1::el9
From an advisory covering 14 CVEs
 before 0:4.1.132-1.Final_redhat_00001.1.el9eap
0:4.1.132-1.Final_redhat_00001.1.el9eap
nodejs22
Rocky Linux:10
From an advisory covering 9 CVEs
 before 1:22.22.2-1.el10_1
1:22.22.2-1.el10_1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-nodemon
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-packaging
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-packaging
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
minimatch
Root:npm
 before 9.0.6-aikido.2
9.0.6-aikido.210.1.1-aikido.310.1.2-aikido.43.0.5-aikido.29.0.0-aikido.43.1.2-aikido.45.1.0-aikido.310.0.1-aikido.45.1.0-aikido.49.0.5-aikido.410.0.3-aikido.49.0.3-aikido.410.2.2-aikido.28.0.4-aikido.35.1.6-aikido.49.0.4-aikido.43.0.8-aikido.33.0.4-aikido.24.2.1-aikido.14.2.3-aikido.17.4.6-aikido.17.4.6-aikido.2
@rootio/minimatch
Root:npm
 before 9.0.6-root.io.2
9.0.6-root.io.29.0.5-root.io.23.1.2-root.io.29.0.5-root.io.33.1.2-root.io.310.0.1-root.io.25.1.6-root.io.310.0.1-root.io.39.0.3-root.io.310.0.3-root.io.35.1.0-root.io.110.1.2-root.io.110.1.2-root.io.210.1.2-root.io.39.0.0-root.io.35.1.0-root.io.210.1.1-root.io.310.1.2-root.io.410.2.2-root.io.13.0.5-root.io.29.0.0-root.io.43.1.2-root.io.45.1.0-root.io.310.0.1-root.io.49.0.5-root.io.45.1.0-root.io.410.1.1-root.io.210.0.3-root.io.43.0.5-root.io.19.0.3-root.io.49.0.6-root.io.110.2.2-root.io.28.0.4-root.io.35.1.6-root.io.49.0.4-root.io.43.0.8-root.io.33.0.4-root.io.24.2.1-root.io.14.2.3-root.io.17.4.6-root.io.17.4.6-root.io.2
cockpit
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 364-160000.1.1
364-160000.1.1
cockpit-machines
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 354-160000.1.1
354-160000.1.1
cockpit-podman
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 128-160000.1.1
128-160000.1.1
cockpit-repos
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 4.8-160000.1.1
4.8-160000.1.1
cockpit-subscriptions
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 16.2-160000.1.1
16.2-160000.1.1
cockpit
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 364-160000.1.1
364-160000.1.1
cockpit-machines
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 354-160000.1.1
354-160000.1.1
cockpit-packages
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 5-160000.1.1
5-160000.1.1
cockpit-podman
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 128-160000.1.1
128-160000.1.1
cockpit-repos
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 4.8-160000.1.1
4.8-160000.1.1
cockpit-subscriptions
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 16.2-160000.1.1
16.2-160000.1.1
cockpit
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 364-160000.1.1
364-160000.1.1
cockpit-machines
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 354-160000.1.1
354-160000.1.1
cockpit-packages
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 5-160000.1.1
5-160000.1.1
cockpit-podman
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 128-160000.1.1
128-160000.1.1
cockpit-repos
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 4.8-160000.1.1
4.8-160000.1.1
cockpit-subscriptions
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 16.2-160000.1.1
16.2-160000.1.1
cockpit
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 4 CVEs
 before 298-150500.3.12.1
298-150500.3.12.1
node-minimatch
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.2.11-10.2.12-10.2.12-1ubuntu0.1~esm2
 None known
node-minimatch
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.0.0-11.0.0-1ubuntu0.1~esm2
 None known
node-minimatch
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.0.4-13.0.4-33.0.4-3+deb10u1build0.18.04.1
 None known
node-minimatch
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.0.4-33.0.4-43.0.4-4ubuntu0.1
 None known
node-minimatch
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.0.4+~3.0.3-13.0.4+~3.0.5-13.1.1+~3.0.5-1
 None known
node-minimatch
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.1.1+~5.1.2-19.0.3-4build5
 None known
node-minimatch
Ubuntu:25.10
 All versions, plus listed versions
9.0.3-59.0.3-6
 None known
node-minimatch
Ubuntu:26.10
 All versions, plus listed versions
9.0.3-69.0.7-1
 None known
node-minimatch
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.0.3-6
 None known
velociraptor
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1
onnxruntime
openSUSE:Tumbleweed
 before 1.26.0-1.1
1.26.0-1.1
openQA
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 5.1782995932.ffeb09be-1.1
5.1782995932.ffeb09be-1.1
cockpit-repos
openSUSE:Tumbleweed
 before 4.9-1.1
4.9-1.1
cockpit-subscriptions
openSUSE:Tumbleweed
 before 16.3-1.1
16.3-1.1
openQA
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 5.1783076943.6691832d-bp160.1.1
5.1783076943.6691832d-bp160.1.1
os-autoinst
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 5.1783082953.c3cb41d-bp160.1.1
5.1783082953.c3cb41d-bp160.1.1
cockpit
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 364-160000.1.1
364-160000.1.1
cockpit-machines
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 354-160000.1.1
354-160000.1.1
cockpit-packages
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 5-160000.1.1
5-160000.1.1
cockpit-podman
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 128-160000.1.1
128-160000.1.1
cockpit-repos
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 4.8-160000.1.1
4.8-160000.1.1
cockpit-subscriptions
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 16.2-160000.1.1
16.2-160000.1.1

History

History
RecordedChangedSources
affected, aliasesOSV
affected
affected, aliases, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27904 is a high vulnerability (CVSS 7.5) in Isaacs Minimatch, published February 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in minimatch 10.2.3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 159 package rows, 231 references and the rest of 2 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 17 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open