{"id":"CVE-2022-3517","aliases":["ALSA-2022:8832","ALSA-2022:8833","ALSA-2022:9073","ALSA-2023:0050","ALSA-2023:0321","ALSA-2023:1743","AZL-44451","AZL-44946","CLSA-2026-1774484498","CLSA-2026-1774484504","CLSA-2026-1774484505","CLSA-2026-1774484507","CLSA-2026-1786361876","CLSA-2026-1790604852","CLSA-2026-1792476336","DEBIAN-CVE-2022-3517","DLA-3271-1","EUVD-2022-7089","GHSA-f8q6-p94x-37v3","MGASA-2025-0194","OESA-2022-2028","RHSA-2022:8832","RHSA-2022:8833","RHSA-2022:9073","RHSA-2023:0050","RHSA-2023:0321","RHSA-2023:0612","RHSA-2023:1533","RHSA-2023:1742","RHSA-2023:1743","RLSA-2022:8832","RLSA-2022:8833","RLSA-2022:9073","RLSA-2023:0050","RLSA-2023:0321","RLSA-2023:1743","ROOT-APP-NPM-CVE-2022-3517","UBUNTU-CVE-2022-3517","USN-6086-1"],"status":"published","title":"minimatch ReDoS vulnerability","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02279,"percentile":0.83272,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2022-10-17T00:00:00Z","modified":"2026-11-05T13:28:26Z","fixes":[{"ecosystem":"npm","package":"minimatch","fixed_in":["3.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"minimatch","fixed_in":["0.0.4-tuxcare.1","3.0.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-minimatch","fixed_in":["3.0.5+~3.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-minimatch","fixed_in":["3.0.5+~3.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-minimatch","fixed_in":["3.0.5+~3.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"node-minimatch","fixed_in":["3.0.4-3+deb10u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-minimatch","fixed_in":["3.0.4-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-minimatch","fixed_in":["3.0.4-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nodejs-minimatch","fixed_in":["3.0.4-2.oe2203"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"minimatch","fixed_in":["3.0.4-aikido.2","3.0.5-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/minimatch","fixed_in":["3.0.4-root.io.2","3.0.5-root.io.2","3.0.5-root.io.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"node-minimatch","fixed_in":["3.0.4-3+deb10u1build0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"node-minimatch","fixed_in":["3.0.4-4ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.18.12.1.1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-1.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.18.12.1.2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25-1.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.16.18.1.3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-3.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.4-tuxcare.0"},{"fixed":"0.0.4-tuxcare.1"}]}],"versions":["0.0.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.5-tuxcare.0"},{"fixed":"0.0.5-tuxcare.1"}]}],"versions":["0.0.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.10-tuxcare.0"},{"fixed":"2.0.10-tuxcare.1"}]}],"versions":["2.0.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.1"}]}],"versions":["3.0.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.5-tuxcare.0"},{"fixed":"0.2.5-tuxcare.1"}]}],"versions":["0.2.5"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0-tuxcare.0"},{"fixed":"0.4.0-tuxcare.1"}]}],"versions":["0.4.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.1"}]}],"versions":["3.0.3"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5+~3.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5+~3.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5+~3.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"node-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-3+deb10u1"}]}],"versions":["3.0.4-3"]},{"source":"osv","ecosystem":"npm","package":"minimatch","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.5"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-0.10.9.2.1.mga9"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nodejs-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-1.module+el8.7.0+17282+f47dd33b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+10992+fac5fe06"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.16.18.1.3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.17-14.21.1.3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+1104+549f92a6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-1.module+el8.7.0+1104+549f92a6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+1108+49363b0d"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+1108+49363b0d"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.6.0+1046+80feca58"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+702+221f14e6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+1116+bd2a84b4"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+1108+49363b0d"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+1183+c2c35f0a"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.7.0+1178+d52dba78"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:npm","package":"minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-aikido.2"},{"fixed":"3.0.5-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-root.io.2"},{"fixed":"3.0.5-root.io.2"},{"fixed":"3.0.5-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-3+deb10u1build0.18.04.1"}]}],"versions":["3.0.4-1","3.0.4-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-4ubuntu0.1"}]}],"versions":["3.0.4-3","3.0.4-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-3+deb10u1build0.18.04.1"}]}],"versions":["3.0.4-1","3.0.4-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-minimatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-4ubuntu0.1"}]}],"versions":["3.0.4-3","3.0.4-4"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"isaacs","product":"minimatch"},{"vendor":"minimatch_project","product":"minimatch"}],"references":[{"url":"https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/grafana/grafana-image-renderer/issues/329","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","tags":["web","advisory"]},{"url":"https://github.com/nodejs/node/issues/42510","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f8q6-p94x-37v3"},{"url":"https://access.redhat.com/errata/RHSA-2022:8832","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3517","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43548","tags":["report"]},{"url":"https://bugzilla.redhat.com/2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140911","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8832.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8833","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2142818","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-8833.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:9073","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44531","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44532","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44533","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44906","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2040839","tags":["report"]},{"url":"https://bugzilla.redhat.com/2040846","tags":["report"]},{"url":"https://bugzilla.redhat.com/2040856","tags":["report"]},{"url":"https://bugzilla.redhat.com/2040862","tags":["report"]},{"url":"https://bugzilla.redhat.com/2066009","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-9073.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0235","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24999","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/2142821","tags":["report"]},{"url":"https://bugzilla.redhat.com/2150323","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-0050.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0321","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-35256","tags":["report"]},{"url":"https://bugzilla.redhat.com/2130518","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-0321.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1743","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35065","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25881","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38900","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23918","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23920","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156324","tags":["report"]},{"url":"https://bugzilla.redhat.com/2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/2170644","tags":["report"]},{"url":"https://bugzilla.redhat.com/2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175826","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-1743.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3517.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3517","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0194.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33674","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UGLXZO6VIHGIITQTEUY5Q5YCAP2A4ZP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2028","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142809","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8832.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3517","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43548","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142818","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8833.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142806","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_9073.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44531","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44532","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44533","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvch-5gv4-984h","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21824","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150323","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0050.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0235","tags":["advisory"]},{"url":"https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","tags":["advisory"]},{"url":"https://github.com/expressjs/express/releases/tag/4.17.3","tags":["article"]},{"url":"https://github.com/ljharb/qs/pull/428","tags":["article"]},{"url":"https://github.com/n8tz/CVE-2022-24999","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2130518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142808","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0321.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35256","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0612","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156324","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0612.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35065","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1533","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175828","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1533.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4904","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/issues/496","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","tags":["advisory"]},{"url":"https://github.com/SamVerschueren/decode-uri-component/issues/5","tags":["article"]},{"url":"https://github.com/advisories/GHSA-w573-4hg7-7wgq","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23918","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23920","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1742","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175827","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175826","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1743.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8832","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8833","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:9073","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0050","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0321","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:1743","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3517","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6086-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3517","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-17T00:00:00Z","modified":"2025-05-13T13:41:10.565Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:33.574107Z"}],"euvd":[{"id":"EUVD-2022-7089","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-17T00:00:00Z","modified":"2025-05-13T13:41:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:48.910403Z"}],"ghsa":[{"id":"GHSA-f8q6-p94x-37v3","title":"minimatch ReDoS vulnerability","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-18T12:00:32Z","modified":"2024-02-14T18:15:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:37:38.20753Z"}],"nvd":[{"id":"CVE-2022-3517","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-17T20:15:09.937Z","modified":"2026-06-17T04:59:40.55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:07:30.6869Z"}],"osv":[{"id":"AZL-44451","title":"CVE-2022-3517 affecting package nodejs-nodemon 2.0.3-5","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-17T20:15:09Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"AZL-44946","title":"CVE-2022-3517 affecting package js-jquery 3.5.0-4","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-17T20:15:09Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2022-3517","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-17T00:00:00Z","modified":"2026-10-28T02:30:45.990130274Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"DEBIAN-CVE-2022-3517","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-17T20:15:09.937Z","modified":"2026-11-03T08:04:09.344295735Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"GHSA-f8q6-p94x-37v3","title":"minimatch ReDoS vulnerability","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-18T12:00:32Z","modified":"2026-09-10T03:49:46.410416632Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"OESA-2022-2028","title":"nodejs-minimatch security update","description":"Converts glob expressions to JavaScript \u0026quot;RegExp\u0026quot; objects.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.(CVE-2022-3517)","status":"published","published":"2022-10-28T11:05:20Z","modified":"2026-08-18T01:17:21.541135791Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2022:8832","title":"Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:30:49Z","modified":"2026-10-13T10:03:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8833","title":"Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:30:48Z","modified":"2026-10-13T10:03:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:9073","title":"Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:31:15Z","modified":"2026-10-13T10:03:36Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0050","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:31:35Z","modified":"2026-10-16T10:01:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0321","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update","status":"published","published":"2024-09-29T22:06:12Z","modified":"2026-10-13T10:03:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0612","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-30T14:32:48Z","modified":"2026-10-16T10:01:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1533","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:37Z","modified":"2026-10-13T10:04:00Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1742","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:46Z","modified":"2026-10-16T10:02:02Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1743","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:35:06Z","modified":"2026-10-13T10:04:02Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RLSA-2022:8832","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809, BZ#2142830, BZ#2142834, BZ#2142856)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-12-06T15:25:25Z","modified":"2025-10-09T05:47:19.050961Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:8833","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1), nodejs-nodemon (2.0.20). (BZ#2142818)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-12-06T15:25:28Z","modified":"2026-02-04T07:40:23.036325Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:9073","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [Rocky Linux-8] (BZ#2151625)","status":"published","published":"2022-12-15T15:42:25Z","modified":"2026-02-04T17:30:10.869137Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:0050","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-09T14:24:14Z","modified":"2026-02-04T20:15:13.503848Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:0321","title":"Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs: Packaged version of undici does not fit with declared version. [Rocky Linux-9] (BZ#2151627)","status":"published","published":"2023-01-23T14:30:11Z","modified":"2026-02-05T10:45:10.757506Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-3517","description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","status":"published","published":"2022-10-17T20:15:00Z","modified":"2026-02-04T02:53:12.042796Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"ALSA-2022:8832","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809, BZ#2142830, BZ#2142834, BZ#2142856)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-12-06T00:00:00Z","modified":"2026-10-29T11:30:44.827992256Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:8833","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1), nodejs-nodemon (2.0.20). (BZ#2142818)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-12-06T00:00:00Z","modified":"2026-10-29T11:01:55.631728128Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:9073","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n* minimist: prototype pollution (CVE-2021-44906)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [almalinux-8] (BZ#2151625)","status":"published","published":"2022-12-15T00:00:00Z","modified":"2026-10-29T11:01:55.56767429Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:0050","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-09T00:00:00Z","modified":"2026-10-29T11:01:56.071099168Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:0321","title":"Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs: Packaged version of undici does not fit with declared version. [almalinux-9] (BZ#2151627)","status":"published","published":"2023-01-23T00:00:00Z","modified":"2026-10-29T11:31:22.338911326Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:1743","title":"Important: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-12T00:00:00Z","modified":"2026-10-29T11:01:36.448211693Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1774484498","title":"TuxCare security update for minimatch (1 CVE)","description":"TuxCare rebuilt minimatch to address 1 CVE. Fixed in 0.0.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:05.790696488Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774484504","title":"TuxCare security update for minimatch (2 CVEs)","description":"TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.0.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:05.286840726Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774484505","title":"TuxCare security update for minimatch (2 CVEs)","description":"TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 2.0.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:05.932499235Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774484507","title":"TuxCare security update for minimatch (1 CVE)","description":"TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.0.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:03.718429071Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1786361876","title":"TuxCare security update for minimatch (4 CVEs)","description":"TuxCare rebuilt minimatch to address 4 CVEs. Fixed in 0.2.5-tuxcare.1.","status":"published","published":"2026-08-10T11:37:56Z","modified":"2026-11-05T13:28:26.176260232Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1790604852","title":"TuxCare security update for minimatch (2 CVEs)","description":"TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.4.0-tuxcare.1.","status":"published","published":"2026-09-28T14:14:12Z","modified":"2026-10-15T09:48:03.102884033Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792476336","title":"TuxCare security update for minimatch (3 CVEs)","description":"TuxCare rebuilt minimatch to address 3 CVEs. Fixed in 3.0.3-tuxcare.1.","status":"published","published":"2026-10-20T06:05:36Z","modified":"2026-10-20T07:15:14.477538793Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"DLA-3271-1","title":"node-minimatch - security update","status":"published","published":"2023-01-15T00:00:00Z","modified":"2026-03-09T01:21:34.455647Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2025-0194","title":"Updated yarnpkg packages fix security vulnerabilities","description":"CVE-2024-37890 yarnpkg: denial of service when handling a request with\nmany HTTP headers.\nCVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature\nVerification.\nCVE-2024-12905 yarnpkg: link following and path traversal via\nmaliciously crafted tar file\nAnd other vulnerabilities in the yarn's bundled nodejs components are\nfixed too, see the references.\n","status":"published","published":"2025-06-25T05:31:45Z","modified":"2026-04-16T04:42:54.764506997Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"RLSA-2023:1743","title":"Important: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-26T15:28:13.052501Z","modified":"2026-02-04T19:30:16.769935Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"ROOT-APP-NPM-CVE-2022-3517","title":"CVE-2022-3517 in minimatch - Patched by Root","description":"Root has patched CVE-2022-3517 in the minimatch package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T15:02:20Z","modified":"2026-08-09T10:15:13.16501362Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"USN-6086-1","title":"node-minimatch vulnerability","description":"It was discovered that minimatch incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a\ndenial of service.\n","status":"published","published":"2023-05-18T08:22:39Z","modified":"2026-02-10T04:43:08Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}