CVE-2026-67214
nanoid Infinite Loop via Negative Size in non-secure module
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
nanoid Infinite Loop via Negative Size in non-secure module
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- Record
CVE-2026-67214- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2026-50326
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- Record
EUVD-2026-50326- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-28wg-ghj8-5hjv
nanoid: non-secure generators can loop indefinitely with negative size
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- Record
GHSA-28wg-ghj8-5hjv- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- Record
CVE-2026-67214- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
nanoid Infinite Loop via Negative Size in non-secure module
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- Record
CVE-2026-67214- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-67214
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- Record
DEBIAN-CVE-2026-67214- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 18 moreShow less
OSVGHSA-28wg-ghj8-5hjv
nanoid: non-secure generators can loop indefinitely with negative size
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- Record
GHSA-28wg-ghj8-5hjv- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVRHSA-2026:48241
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:48241- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:48320
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:48320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:59030
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:59030- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:71113
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:71113- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-67214
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- Record
UBUNTU-CVE-2026-67214- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1790609840 No score
TuxCare security update for nanoid (4 CVEs)
TuxCare rebuilt nanoid to address 4 CVEs. Fixed in 3.3.7-tuxcare.2.
- Record
CLSA-2026-1790609840- Updated
- 2026-11-02
OSVCLSA-2026-1790622758 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 3.3.14-tuxcare.1.
- Record
CLSA-2026-1790622758- Updated
- 2026-11-02
OSVCLSA-2026-1790622992 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 5.1.15-tuxcare.1.
- Record
CLSA-2026-1790622992- Updated
- 2026-11-02
OSVCLSA-2026-1790673732 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 5.1.11-tuxcare.1.
- Record
CLSA-2026-1790673732- Updated
- 2026-11-02
OSVCLSA-2026-1791196334 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.12-tuxcare.2.
- Record
CLSA-2026-1791196334- Updated
- 2026-11-02
OSVCLSA-2026-1791396501 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 5.1.6-tuxcare.1.
- Record
CLSA-2026-1791396501- Updated
- 2026-11-02
OSVCLSA-2026-1791626324 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.6-tuxcare.2.
- Record
CLSA-2026-1791626324- Updated
- 2026-11-02
OSVCLSA-2026-1791626479 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 3.3.11-tuxcare.2.
- Record
CLSA-2026-1791626479- Updated
- 2026-11-02
OSVCLSA-2026-1791626714 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.4-tuxcare.2.
- Record
CLSA-2026-1791626714- Updated
- 2026-11-02
OSVCLSA-2026-1791806453 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.8-tuxcare.1.
- Record
CLSA-2026-1791806453- Updated
- 2026-11-02
OSVCLSA-2026-1792232027 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 5.1.5-tuxcare.3.
- Record
CLSA-2026-1792232027- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-67214 No score
CVE-2026-67214 in nanoid - Patched by Root
Root has patched CVE-2026-67214 in the nanoid package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-67214- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nanoidnpm |
before 3.3.16 | 3.3.16 |
nanoidnpm |
4.0.0 up to 5.1.16 | 5.1.16 |
nanoidTuxCare:npm From an advisory covering 4 CVEs |
3.3.7-tuxcare.0 up to 3.3.7-tuxcare.2, plus listed versions 3.3.73.3.7-tuxcare.1 |
3.3.7-tuxcare.2 |
nanoidTuxCare:npm |
3.3.14-tuxcare.0 up to 3.3.14-tuxcare.1, plus listed versions 3.3.14 |
3.3.14-tuxcare.1 |
nanoidTuxCare:npm |
5.1.15-tuxcare.0 up to 5.1.15-tuxcare.1, plus listed versions 5.1.15 |
5.1.15-tuxcare.1 |
nanoidTuxCare:npm |
5.1.11-tuxcare.0 up to 5.1.11-tuxcare.1, plus listed versions 5.1.11 |
5.1.11-tuxcare.1 |
nanoidTuxCare:npm From an advisory covering 2 CVEs |
3.3.12-tuxcare.0 up to 3.3.12-tuxcare.2, plus listed versions 3.3.123.3.12-tuxcare.1 |
3.3.12-tuxcare.2 |
nanoidTuxCare:npm From an advisory covering 2 CVEs |
5.1.6-tuxcare.0 up to 5.1.6-tuxcare.1, plus listed versions 5.1.6 |
5.1.6-tuxcare.1 |
nanoidTuxCare:npm From an advisory covering 2 CVEs |
3.3.6-tuxcare.0 up to 3.3.6-tuxcare.2, plus listed versions 3.3.63.3.6-tuxcare.1 |
3.3.6-tuxcare.2 |
nanoidTuxCare:npm |
3.3.11-tuxcare.0 up to 3.3.11-tuxcare.2, plus listed versions 3.3.113.3.11-tuxcare.1 |
3.3.11-tuxcare.2 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nanoidTuxCare:npm From an advisory covering 2 CVEs |
3.3.4-tuxcare.0 up to 3.3.4-tuxcare.2, plus listed versions 3.3.43.3.4-tuxcare.1 |
3.3.4-tuxcare.2 |
nanoidTuxCare:npm From an advisory covering 2 CVEs |
3.3.8-tuxcare.0 up to 3.3.8-tuxcare.1, plus listed versions 3.3.8 |
3.3.8-tuxcare.1 |
nanoidTuxCare:npm |
5.1.5-tuxcare.0 up to 5.1.5-tuxcare.3, plus listed versions 5.1.55.1.5-tuxcare.15.1.5-tuxcare.2 |
5.1.5-tuxcare.3 |
node-mochaDebian:12 |
before 9.1.4+ds1+~cs28.2.8-1 | 9.1.4+ds1+~cs28.2.8-1 |
node-mochaDebian:13 |
before 9.1.4+ds1+~cs28.2.8-1 | 9.1.4+ds1+~cs28.2.8-1 |
node-mochaDebian:14 |
before 9.1.4+ds1+~cs28.2.8-1 | 9.1.4+ds1+~cs28.2.8-1 |
node-postcssDebian:12 |
All versions, plus listed versions 8.4.20+~cs8.0.23-18.4.20+~cs8.0.23-1+deb12u18.4.31+~cs8.0.26-18.4.39+~cs9.2.29-18.4.49+~cs9.2.32-1 Show 15 moreShow less8.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-18.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.31+~cs10.2.26-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1 |
None known |
node-postcssDebian:13 |
All versions, plus listed versions 8.4.49+~cs9.2.32-18.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-1 Show 11 moreShow less8.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.31+~cs10.2.26-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1 |
None known |
node-postcssDebian:14 |
before 8.5.15+~cs9.3.39-1, plus listed versions 8.4.49+~cs9.2.32-18.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1 |
8.5.15+~cs9.3.39-1 |
grafana13.1Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:13.1.1-0.3.hum1 | 0:13.1.1-0.3.hum1 |
jaegerRed Hat:hummingbird:1 |
before 0:2.20.0-0.7.hum1 | 0:2.20.0-0.7.hum1 |
grafana13.2Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:13.2.0-0.1.1.hum1 | 0:13.2.0-0.1.1.hum1 |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el10ap | 0:1.6.8-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.14-1.el9ap | 0:2.6.14-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
nanoidRoot:npm |
before 3.3.4-aikido.2 | 3.3.4-aikido.23.3.4-aikido.13.3.11-aikido.23.3.8-aikido.23.3.7-aikido.33.3.11-aikido.13.3.12-aikido.13.3.13-aikido.13.3.15-aikido.13.3.8-aikido.13.3.7-aikido.13.3.7-aikido.23.1.20-aikido.53.3.16-aikido.1 |
@rootio/nanoidRoot:npm |
before 3.3.4-root.io.2 | 3.3.4-root.io.23.3.4-root.io.13.3.11-root.io.23.3.8-root.io.23.3.7-root.io.33.3.11-root.io.13.3.12-root.io.13.3.13-root.io.13.3.15-root.io.13.3.8-root.io.13.3.7-root.io.13.3.7-root.io.23.1.20-root.io.53.3.16-root.io.1 |
node-postcssUbuntu:20.04:LTS |
All versions, plus listed versions 6.0.23-16.0.23-3 |
None known |
node-postcssUbuntu:22.04:LTS |
All versions, plus listed versions 8.2.1+~cs5.3.23-88.4.5+~cs7.1.51-28.4.6+~cs7.3.21-1 |
None known |
node-postcssUbuntu:24.04:LTS |
All versions, plus listed versions 8.4.20+~cs8.0.23-18.4.31+~cs8.0.26-1 |
None known |
node-postcssUbuntu:26.04:LTS |
All versions, plus listed versions 8.5.6+~cs9.3.28-18.5.8+~cs9.3.30-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-67214 is a high vulnerability (CVSS 8.2) in Nanoid Project Nanoid, published July 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in nanoid 3.3.16.
References
github.com/ai/nanoid/releases/tag/5.1.16
vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
nvd.nist.gov/vuln/detail/CVE-2026-67214
Show 194 moreShow less
security-tracker.debian.org/tracker/CVE-2026-67214
access.redhat.com/errata/RHSA-2026:48241
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48241.json
bugzilla.redhat.com/show_bug.cgi?id=2508406
cve.org/CVERecord?id=CVE-2026-67213
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
go.dev/cl/814980
groups.google.com/g/golang-announce/c/94pEornpRlI
pkg.go.dev/vuln/GO-2026-5972
ubuntu.com/security/CVE-2026-67214
Left out here: 165 references. The JSON record has them.