CVE-2026-48932
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding...
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- Record
CVE-2026-48932- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2026-68923
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- Record
EUVD-2026-68923- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-44cw-v76j-7fvv
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding...
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- Record
GHSA-44cw-v76j-7fvv- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
NVD
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- Record
CVE-2026-48932- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-48932
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- Record
DEBIAN-CVE-2026-48932- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:54389
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:54389- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2026:54436
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:54436- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:54438
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:54438- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-48932
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- Record
UBUNTU-CVE-2026-48932- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVBIT-node-2026-48932 No score
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- Record
BIT-node-2026-48932- Updated
- 2026-11-02
OSVBIT-node-min-2026-48932 No score
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.
Node.js can omit headers beyond maxHeadersCount / maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, while still using those omitted headers internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
- Record
BIT-node-min-2026-48932- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nodeBitnami |
before 22.23.0, 23.0.0 up to 24.17.0, 25.0.0 up to 26.3.1 | 22.23.024.17.026.3.1 |
node-minBitnami |
before 22.23.0, 23.0.0 up to 24.17.0, 25.0.0 up to 26.3.1 | 22.23.024.17.026.3.1 |
nodejsDebian:12 |
All versions, plus listed versions 18.13.0+dfsg1-118.13.0+dfsg1-1.118.19.0+dfsg-118.19.0+dfsg-218.19.0+dfsg-3 Show 45 moreShow less18.19.0+dfsg-418.19.0+dfsg-518.19.0+dfsg-618.19.0+dfsg-6~deb12u118.19.0+dfsg-6~deb12u218.19.1+dfsg-118.19.1+dfsg-218.19.1+dfsg-318.19.1+dfsg-3.118.19.1+dfsg-418.19.1+dfsg-618.20.1+dfsg-118.20.1+dfsg-218.20.1+dfsg-318.20.1+dfsg-418.20.4+dfsg-1~deb12u118.20.4+dfsg-1~deb12u220.10.0+dfsg-120.12.2+dfsg-120.13.0+dfsg-120.13.1+dfsg-120.13.1+dfsg-220.14.0+dfsg-120.14.0+dfsg-220.14.0+dfsg-320.15.0+dfsg-120.15.1+dfsg-120.16.0+dfsg-120.17.0+dfsg-120.17.0+dfsg-220.18.0+dfsg-120.18.0+dfsg-220.18.1+dfsg-120.18.1+dfsg-220.18.2+dfsg-120.18.2+dfsg-220.18.2+dfsg-320.18.2+dfsg-420.18.3+dfsg-120.19.0+dfsg-120.19.0+dfsg-220.19.0+dfsg1-120.19.2+dfsg-120.19.4+dfsg-120.19.5+dfsg+~cs20.19.12-1 |
None known |
nodejsDebian:13 |
All versions, plus listed versions 20.19.2+dfsg-120.19.2+dfsg-1+deb13u120.19.2+dfsg-1+deb13u220.19.2+dfsg-1+deb13u320.19.4+dfsg-1 Show 42 moreShow less20.19.5+dfsg+~cs20.19.12-120.19.5+dfsg+~cs20.19.12-220.19.5+dfsg+~cs20.19.12-320.19.5+dfsg+~cs20.19.12-420.19.5+dfsg+~cs20.19.24-122.12.0+dfsg-122.12.0+dfsg-222.12.0+dfsg-322.14.0+dfsg-122.18.0+dfsg+~cs22.17.2-122.18.0+dfsg+~cs22.17.2-222.18.0+dfsg-122.19.0+dfsg+~cs22.18.0-122.21.1+dfsg+~cs22.19.0-122.21.1+dfsg+~cs22.19.0-222.21.1+dfsg+~cs22.19.0-322.21.1+dfsg+~cs22.19.0-422.21.1+dfsg+~cs22.19.0-522.21.1+dfsg+~cs22.19.0-622.22.0+dfsg+~cs22.19.13-122.22.0+dfsg+~cs22.19.13-222.22.0+dfsg+~cs22.19.6-122.22.1+dfsg+~cs22.19.15-122.22.2+dfsg+~cs22.19.15-122.22.2+dfsg+~cs22.19.15-324.11.1+dfsg+~cs24.10.1-124.11.1+dfsg+~cs24.10.1-224.12.0+dfsg+~cs24.10.4-124.13.0+dfsg+~cs24.10.7-124.13.0+dfsg+~cs24.10.7-224.14.0+dfsg+~cs24.12.0-124.14.0+dfsg+~cs24.12.0-224.14.1+dfsg+~cs24.12.0-124.15.0+dfsg+~cs24.12.2-124.16.0+dfsg+~cs24.13.1-124.16.0+dfsg+~cs24.13.1-224.17.0+dfsg+~cs24.13.2-124.18.0+dfsg+~cs24.13.2-124.19.0+dfsg+~cs24.13.3-124.20.0+dfsg+~cs24.13.3-124.20.0+dfsg+~cs24.13.3-224.21.0+dfsg+~cs24.13.4-1 |
None known |
nodejsDebian:14 |
before 24.19.0+dfsg+~cs24.13.3-1, plus listed versions 20.19.2+dfsg-120.19.4+dfsg-120.19.5+dfsg+~cs20.19.12-120.19.5+dfsg+~cs20.19.12-220.19.5+dfsg+~cs20.19.12-3 Show 35 moreShow less20.19.5+dfsg+~cs20.19.12-420.19.5+dfsg+~cs20.19.24-122.12.0+dfsg-122.12.0+dfsg-222.12.0+dfsg-322.14.0+dfsg-122.18.0+dfsg+~cs22.17.2-122.18.0+dfsg+~cs22.17.2-222.18.0+dfsg-122.19.0+dfsg+~cs22.18.0-122.21.1+dfsg+~cs22.19.0-122.21.1+dfsg+~cs22.19.0-222.21.1+dfsg+~cs22.19.0-322.21.1+dfsg+~cs22.19.0-422.21.1+dfsg+~cs22.19.0-522.21.1+dfsg+~cs22.19.0-622.22.0+dfsg+~cs22.19.13-122.22.0+dfsg+~cs22.19.13-222.22.0+dfsg+~cs22.19.6-122.22.1+dfsg+~cs22.19.15-122.22.2+dfsg+~cs22.19.15-122.22.2+dfsg+~cs22.19.15-324.11.1+dfsg+~cs24.10.1-124.11.1+dfsg+~cs24.10.1-224.12.0+dfsg+~cs24.10.4-124.13.0+dfsg+~cs24.10.7-124.13.0+dfsg+~cs24.10.7-224.14.0+dfsg+~cs24.12.0-124.14.0+dfsg+~cs24.12.0-224.14.1+dfsg+~cs24.12.0-124.15.0+dfsg+~cs24.12.2-124.16.0+dfsg+~cs24.13.1-124.16.0+dfsg+~cs24.13.1-224.17.0+dfsg+~cs24.13.2-124.18.0+dfsg+~cs24.13.2-1 |
24.19.0+dfsg+~cs24.13.3-1 |
nodejs26Red Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:26.7.0-1.5.2.hum1 | 0:26.7.0-1.5.2.hum1 |
nodejs26-binRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:26.7.0-1.5.2.hum1 | 0:26.7.0-1.5.2.hum1 |
nodejs26-develRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:26.7.0-1.5.2.hum1 | 0:26.7.0-1.5.2.hum1 |
nodejs26-docsRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:26.7.0-1.5.2.hum1 | 0:26.7.0-1.5.2.hum1 |
nodejs26-full-i18nRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:26.7.0-1.5.2.hum1 | 0:26.7.0-1.5.2.hum1 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nodejs26-libsRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:26.7.0-1.5.2.hum1 | 0:26.7.0-1.5.2.hum1 |
nodejs26-npmRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:11.19.0-1.26.7.0.1.5.2.hum1 | 0:11.19.0-1.26.7.0.1.5.2.hum1 |
nodejs26-npm-binRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:26.7.0-1.5.2.hum1 | 0:26.7.0-1.5.2.hum1 |
v8-14.6-develRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:14.6.202.34-1.26.7.0.1.5.2.hum1 | 0:14.6.202.34-1.26.7.0.1.5.2.hum1 |
nodejs22Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:22.23.2-2.3.2.hum1 | 0:22.23.2-2.3.2.hum1 |
nodejs22-binRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:22.23.2-2.3.2.hum1 | 0:22.23.2-2.3.2.hum1 |
nodejs22-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:22.23.2-2.3.2.hum1 | 0:22.23.2-2.3.2.hum1 |
nodejs22-docsRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:22.23.2-2.3.2.hum1 | 0:22.23.2-2.3.2.hum1 |
nodejs22-full-i18nRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:22.23.2-2.3.2.hum1 | 0:22.23.2-2.3.2.hum1 |
nodejs22-libsRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:22.23.2-2.3.2.hum1 | 0:22.23.2-2.3.2.hum1 |
nodejs22-npmRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:10.9.8-1.22.23.2.2.3.2.hum1 | 0:10.9.8-1.22.23.2.2.3.2.hum1 |
nodejs22-npm-binRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:22.23.2-2.3.2.hum1 | 0:22.23.2-2.3.2.hum1 |
v8-12.4-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:12.4.254.21-1.22.23.2.2.3.2.hum1 | 0:12.4.254.21-1.22.23.2.2.3.2.hum1 |
nodejs24Red Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:24.18.1-0.2.2.hum1 | 0:24.18.1-0.2.2.hum1 |
nodejs24-binRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:24.18.1-0.2.2.hum1 | 0:24.18.1-0.2.2.hum1 |
nodejs24-develRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:24.18.1-0.2.2.hum1 | 0:24.18.1-0.2.2.hum1 |
nodejs24-docsRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:24.18.1-0.2.2.hum1 | 0:24.18.1-0.2.2.hum1 |
nodejs24-full-i18nRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:24.18.1-0.2.2.hum1 | 0:24.18.1-0.2.2.hum1 |
nodejs24-libsRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:24.18.1-0.2.2.hum1 | 0:24.18.1-0.2.2.hum1 |
nodejs24-npmRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:11.16.0-1.24.18.1.0.2.2.hum1 | 0:11.16.0-1.24.18.1.0.2.2.hum1 |
nodejs24-npm-binRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:24.18.1-0.2.2.hum1 | 0:24.18.1-0.2.2.hum1 |
nodejsUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.10.15~dfsg1-40.10.21~dfsg1-10.10.22~dfsg1-20.10.23~dfsg1-10.10.23~dfsg1-2 Show 7 moreShow less0.10.23~dfsg1-30.10.24~dfsg1-10.10.25~dfsg2-20.10.25~dfsg2-2ubuntu10.10.25~dfsg2-2ubuntu1.20.10.25~dfsg2-2ubuntu1.2+esm10.10.25~dfsg2-2ubuntu1.2+esm2 |
None known |
nodejsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2 Show 7 moreShow less4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm14.2.6~dfsg-1ubuntu4.2+esm24.2.6~dfsg-1ubuntu4.2+esm3 |
None known |
nodejsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2 Show 10 moreShow less8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm18.10.0~dfsg-2ubuntu0.4+esm28.10.0~dfsg-2ubuntu0.4+esm38.10.0~dfsg-2ubuntu0.4+esm48.10.0~dfsg-2ubuntu0.4+esm58.10.0~dfsg-2ubuntu0.4+esm6 |
None known |
nodejsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 10.15.2~dfsg-2ubuntu110.17.0~dfsg-2ubuntu410.17.0~dfsg-2ubuntu610.19.0~dfsg-3ubuntu110.19.0~dfsg-3ubuntu1.1 Show 5 moreShow less10.19.0~dfsg-3ubuntu1.210.19.0~dfsg-3ubuntu1.310.19.0~dfsg-3ubuntu1.510.19.0~dfsg-3ubuntu1.610.19.0~dfsg-3ubuntu1.6+esm2 |
None known |
nodejsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3 Show 7 moreShow less12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2 |
None known |
nodejsUbuntu:24.04:LTS |
All versions, plus listed versions 18.13.0+dfsg1-1ubuntu218.19.1+dfsg-2ubuntu418.19.1+dfsg-6ubuntu118.19.1+dfsg-6ubuntu218.19.1+dfsg-6ubuntu5 |
None known |
nodejsUbuntu:26.10 |
All versions, plus listed versions 22.22.1+dfsg+~cs22.19.15-1ubuntu124.16.0+dfsg+~cs24.13.1-2ubuntu124.18.0+dfsg+~cs24.13.2-1ubuntu124.19.0+dfsg+~cs24.13.3-1ubuntu1 |
None known |
nodejsUbuntu:26.04:LTS |
All versions, plus listed versions 20.19.4+dfsg-120.19.5+dfsg+~cs20.19.12-422.21.1+dfsg+~cs22.19.0-6ubuntu422.22.0+dfsg+~cs22.19.6-1ubuntu222.22.0+dfsg+~cs22.19.13-2ubuntu122.22.1+dfsg+~cs22.19.15-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48932 is a low vulnerability (CVSS 3.7) in Nodejs Node, published August 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in node 22.23.0.
References
hackerone.com/reports/3564941
nvd.nist.gov/vuln/detail/CVE-2026-48932
github.com/advisories/GHSA-44cw-v76j-7fvv
security-tracker.debian.org/tracker/CVE-2026-48932
access.redhat.com/errata/RHSA-2026:54389
Show 67 moreShow less
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54389.json
bugzilla.redhat.com/show_bug.cgi?id=2506433
cve.org/CVERecord?id=CVE-2026-14257
npmjs.com/package/brace-expansion
cna.openjsf.org/security-advisories.html
ubuntu.com/security/CVE-2026-48932
Left out here: 41 versions. The JSON record has them.