{"id":"CVE-2026-102276","aliases":["ALSA-2026:92376","ALSA-2026:92378","ALSA-2026:96088","ALSA-2026:96094","ALSA-2026:96234","ALSA-2026:96236","AZL-105075","AZL-105096","AZL-105248","CLSA-2026-1790807349","CLSA-2026-1790807354","CLSA-2026-1790807467","CLSA-2026-1790856945","CLSA-2026-1790863041","CLSA-2026-1790864778","CLSA-2026-1790887113","CLSA-2026-1791215851","CLSA-2026-1791215922","CLSA-2026-1791226379","CLSA-2026-1791226863","CLSA-2026-1791278923","CLSA-2026-1791626852","CLSA-2026-1791629378","CLSA-2026-1791798665","CLSA-2026-1792233030","CLSA-2026-1792448853","CLSA-2026-1792453589","CLSA-2026-1792479350","CLSA-2026-1793102029","CLSA-2026-1793180819","DEBIAN-CVE-2026-102276","EUVD-2026-88550","GHSA-6j4f-fj2g-mc7p","RHSA-2026:74161","RHSA-2026:74167","RHSA-2026:74168","RHSA-2026:84657","RLSA-2026:92376","RLSA-2026:92378","RLSA-2026:96088","RLSA-2026:96094","RLSA-2026:96226","RLSA-2026:96234","RLSA-2026:96236","RLSA-2026:98102","RLSA-2026:98113","RLSA-2026:98522","UBUNTU-CVE-2026-102276","openSUSE-SU-2026:12062-1","openSUSE-SU-2026:22111-1"],"status":"published","title":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00455,"percentile":0.3994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-674"],"published":"2026-09-28T20:50:59Z","modified":"2026-11-12T00:30:03Z","fixes":[{"ecosystem":"npm","package":"brace-expansion","fixed_in":["5.0.10","3.0.7","2.1.5","1.1.19"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"brace-expansion","fixed_in":["4.0.1-tuxcare.1","2.0.2-tuxcare.1","1.1.18-tuxcare.1","1.1.16-tuxcare.1","1.1.15-tuxcare.1","1.1.14-tuxcare.1","5.0.9-tuxcare.1","2.1.4-tuxcare.1","2.1.3-tuxcare.2","5.0.8-tuxcare.2","2.1.2-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-brace-expansion","fixed_in":["2.1.7+~1.1.2-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"pi-coding-agent","fixed_in":["1.0.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.19"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:11.19.1-1.24.22.1.3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.9-1.22.23.4.1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.2-6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.1"}]}],"versions":["4.0.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.1"}]}],"versions":["2.0.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.18-tuxcare.0"},{"fixed":"1.1.18-tuxcare.1"}]}],"versions":["1.1.18"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.16-tuxcare.0"},{"fixed":"1.1.16-tuxcare.1"}]}],"versions":["1.1.16"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15-tuxcare.0"},{"fixed":"1.1.15-tuxcare.1"}]}],"versions":["1.1.15"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.14-tuxcare.0"},{"fixed":"1.1.14-tuxcare.1"}]}],"versions":["1.1.14"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.1-tuxcare.0"},{"fixed":"2.0.1-tuxcare.4"}]}],"versions":["2.0.1","2.0.1-tuxcare.1","2.0.1-tuxcare.2","2.0.1-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.9-tuxcare.0"},{"fixed":"5.0.9-tuxcare.1"}]}],"versions":["5.0.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.4-tuxcare.0"},{"fixed":"2.1.4-tuxcare.1"}]}],"versions":["2.1.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.3-tuxcare.0"},{"fixed":"2.1.3-tuxcare.2"}]}],"versions":["2.1.3","2.1.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.8-tuxcare.0"},{"fixed":"5.0.8-tuxcare.2"}]}],"versions":["5.0.8","5.0.8-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2-tuxcare.0"},{"fixed":"2.1.2-tuxcare.3"}]}],"versions":["2.1.2","2.1.2-tuxcare.1","2.1.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.11-tuxcare.0"},{"fixed":"1.1.11-tuxcare.3"}]}],"versions":["1.1.11","1.1.11-tuxcare.1","1.1.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.4-tuxcare.0"},{"fixed":"5.0.4-tuxcare.2"}]}],"versions":["5.0.4","5.0.4-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5-tuxcare.0"},{"fixed":"5.0.5-tuxcare.2"}]}],"versions":["5.0.5","5.0.5-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.12-tuxcare.0"},{"fixed":"1.1.12-tuxcare.5"}]}],"versions":["1.1.12","1.1.12-tuxcare.1","1.1.12-tuxcare.2","1.1.12-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.6-tuxcare.0"},{"fixed":"5.0.6-tuxcare.1"}]}],"versions":["5.0.6"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3-tuxcare.0"},{"fixed":"5.0.3-tuxcare.1"}]}],"versions":["5.0.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2-tuxcare.0"},{"fixed":"5.0.2-tuxcare.1"}]}],"versions":["5.0.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.3-tuxcare.0"},{"fixed":"1.1.3-tuxcare.2"}]}],"versions":["1.1.3","1.1.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1-tuxcare.0"},{"fixed":"1.1.1-tuxcare.1"}]}],"versions":["1.1.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2","2.0.1-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.7+~1.1.2-1"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"5.0.10"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.5"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.19"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.9-1.22.23.3.2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.6.233.17-1.24.21.0.1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.1-1.26.10.0.0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.20.0-1.26.11.1.0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.11.1-0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.11.1.0.4.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module+el9.8.0+40401+e24b8c95"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40264+d9b257bb"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40280+057606e8"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1","1.1.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2","2.0.1+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pi-coding-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"pi-coding-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-bp160.1.1"}]}],"bundled":11}],"products":[{"vendor":"juliangruber","product":"brace-expansion"}],"references":[{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p"},{"url":"https://access.redhat.com/errata/RHSA-2026:92376","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102277","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102278","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105481","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105482","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106069","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106071","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106074","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560022","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92376.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92378","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-92378.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109829","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109869","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553656","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553677","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553678","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553679","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96088.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96094","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96094.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96234","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96234.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96236","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96236.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-102276","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74161","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74161.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74167","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74167.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74168","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74168.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84657","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109841","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109932","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87029","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84657.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87029","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/f75eac00ac17","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/26c2bfb3def0","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553669","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/4f7ef6806e53","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553656","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/b5084c7dc239","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/789ef26461c","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553687","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92376","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560022","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92378","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96088","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96094","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96226","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563978","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96226","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96234","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96236","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98102","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98102","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98113","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98113","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98522","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98522","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-102276","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102276","tags":["web"]},{"url":"https://bugzilla.suse.com/1279832","tags":["report"]},{"url":"https://bugzilla.suse.com/1283188","tags":["report"]},{"url":"https://bugzilla.suse.com/1283392","tags":["report"]},{"url":"https://bugzilla.suse.com/1283412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85152","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-102276","title":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T20:50:59.984Z","modified":"2026-09-29T13:38:29.919Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T13:38:54.394896Z"}],"euvd":[{"id":"EUVD-2026-88550","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T20:50:59Z","modified":"2026-09-29T13:38:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:52.331616Z"}],"ghsa":[{"id":"GHSA-6j4f-fj2g-mc7p","title":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","description":"### Summary\n\n`parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string.\n\nThis is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made `expand_()` iterative and documented a constant-stack-depth guarantee, but `parseCommaParts()` was left recursive, so the guarantee only held for one of the two parsing paths.\n\n### Vector 1 - unbounded recursion on `post`\n\n`parseCommaParts()` recursed on the remainder of the string once per brace group:\n\n```js\nconst postParts = parseCommaParts(post)   // unbounded\n```\n\nA brace group containing many comma-separated groups drives one recursion level per group:\n\n```js\nexpand('{' + '{a},'.repeat(7000) + 'b}')\n// RangeError: Maximum call stack size exceeded\n```\n\nAbout 7,300 repetitions - roughly 29 KB of input - is enough on Node 24; roughly 6,300 (25 KB) on Node 18. The threshold is identical on every affected release line.\n\n### Vector 2 - `push.apply` with an unbounded array\n\nEven with the recursion removed, `parseCommaParts()` spread whole arrays into an argument list:\n\n```js\np.push.apply(p, postParts)\nparts.push.apply(parts, p)\n```\n\n`Function.prototype.apply` places one argument per element on the stack, so a single large array overflows it. This needs **no recursion depth at all** - the following reaches a recursion depth of exactly 1:\n\n```js\nexpand('{{x},' + 'a,'.repeat(125000) + 'b}')\n// RangeError: Maximum call stack size exceeded\n```\n\nThreshold is about 124,300 repetitions (~249 KB). This vector was not part of the original report; it was found while verifying the fix. A patch that only de-recurses but keeps `push.apply` leaves a working denial of service behind.\n\n### Why `max` and `maxLength` do not help\n\nBoth crashes happen during **parsing**, before any expansion. The payloads produce one result per group, so output size grows linearly with input and is never the limiter. `expand(payload, { max: 1, maxLength: 1 })` still overflows.\n\n### Impact\n\nAny application that passes an untrusted string to `expand()` - directly, or through `minimatch` / `glob` where it is a user-supplied glob pattern - can be crashed. In Node, a `RangeError` that the application does not catch terminates the process, so a server that globs user input is exposed to remote unauthenticated denial of service.\n\n`minimatch`'s own `MAX_PATTERN_LENGTH` cap (65,536) does not help against vector 1: the overflow threshold sits well below it. Confirmed on minimatch 10.2.6 - a 64,003-byte pattern passes the length check and overflows both `minimatch.braceExpand()` and `new minimatch.Minimatch()`.\n\nThis is an availability-only issue. No code execution and no data exposure.\n\n### Not a regression\n\n5.0.8 and 5.0.9 overflow at the same repetition count, so the gap predates the recent advisories; those fixes simply did not reach it. Verified affected on 1.1.18, 2.1.4, 3.0.6, 5.0.8 and 5.0.9, all at an identical threshold.\n\n### Patch\n\n`parseCommaParts()` is rewritten as a loop that carries the partial part across chunks, and every array append uses an element-by-element loop rather than `push.apply`. The redundant `if (!str) return ['']` guard is dropped - the loop returns `['']` for the empty string on its own.\n\nEquivalence of the old and new implementations was checked by differential testing: exhaustive over every string of `{`, `}`, `,`, `a` up to length 7 plus 300,000 random inputs - 322,000 cases, zero mismatches.\n\n### Severity note\n\nScored 7.5 High under CVSS 3.1 for consistency with the other availability advisories on this package (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), which use the same vector. The reporter self-assessed 6.9 Medium under CVSS 4.0 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`).\n\n### Credit\n\nReported by baeseungwon1010, with a working proof of concept and a proposed patch. Vector 2 was identified during maintainer verification.","status":"published","published":"2026-09-29T23:44:58Z","modified":"2026-09-29T23:44:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-102276","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T21:17:16.033Z","modified":"2026-09-30T19:57:08.043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T14:12:52.413234Z"}],"osv":[{"id":"CVE-2026-102276","title":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T20:50:59.984Z","modified":"2026-11-10T12:12:23.09155519Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-10T11:27:53.515768Z"},{"id":"DEBIAN-CVE-2026-102276","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T21:17:16.033Z","modified":"2026-10-09T17:00:11.508512287Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-6j4f-fj2g-mc7p","title":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","description":"### Summary\n\n`parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string.\n\nThis is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made `expand_()` iterative and documented a constant-stack-depth guarantee, but `parseCommaParts()` was left recursive, so the guarantee only held for one of the two parsing paths.\n\n### Vector 1 - unbounded recursion on `post`\n\n`parseCommaParts()` recursed on the remainder of the string once per brace group:\n\n```js\nconst postParts = parseCommaParts(post)   // unbounded\n```\n\nA brace group containing many comma-separated groups drives one recursion level per group:\n\n```js\nexpand('{' + '{a},'.repeat(7000) + 'b}')\n// RangeError: Maximum call stack size exceeded\n```\n\nAbout 7,300 repetitions - roughly 29 KB of input - is enough on Node 24; roughly 6,300 (25 KB) on Node 18. The threshold is identical on every affected release line.\n\n### Vector 2 - `push.apply` with an unbounded array\n\nEven with the recursion removed, `parseCommaParts()` spread whole arrays into an argument list:\n\n```js\np.push.apply(p, postParts)\nparts.push.apply(parts, p)\n```\n\n`Function.prototype.apply` places one argument per element on the stack, so a single large array overflows it. This needs **no recursion depth at all** - the following reaches a recursion depth of exactly 1:\n\n```js\nexpand('{{x},' + 'a,'.repeat(125000) + 'b}')\n// RangeError: Maximum call stack size exceeded\n```\n\nThreshold is about 124,300 repetitions (~249 KB). This vector was not part of the original report; it was found while verifying the fix. A patch that only de-recurses but keeps `push.apply` leaves a working denial of service behind.\n\n### Why `max` and `maxLength` do not help\n\nBoth crashes happen during **parsing**, before any expansion. The payloads produce one result per group, so output size grows linearly with input and is never the limiter. `expand(payload, { max: 1, maxLength: 1 })` still overflows.\n\n### Impact\n\nAny application that passes an untrusted string to `expand()` - directly, or through `minimatch` / `glob` where it is a user-supplied glob pattern - can be crashed. In Node, a `RangeError` that the application does not catch terminates the process, so a server that globs user input is exposed to remote unauthenticated denial of service.\n\n`minimatch`'s own `MAX_PATTERN_LENGTH` cap (65,536) does not help against vector 1: the overflow threshold sits well below it. Confirmed on minimatch 10.2.6 - a 64,003-byte pattern passes the length check and overflows both `minimatch.braceExpand()` and `new minimatch.Minimatch()`.\n\nThis is an availability-only issue. No code execution and no data exposure.\n\n### Not a regression\n\n5.0.8 and 5.0.9 overflow at the same repetition count, so the gap predates the recent advisories; those fixes simply did not reach it. Verified affected on 1.1.18, 2.1.4, 3.0.6, 5.0.8 and 5.0.9, all at an identical threshold.\n\n### Patch\n\n`parseCommaParts()` is rewritten as a loop that carries the partial part across chunks, and every array append uses an element-by-element loop rather than `push.apply`. The redundant `if (!str) return ['']` guard is dropped - the loop returns `['']` for the empty string on its own.\n\nEquivalence of the old and new implementations was checked by differential testing: exhaustive over every string of `{`, `}`, `,`, `a` up to length 7 plus 300,000 random inputs - 322,000 cases, zero mismatches.\n\n### Severity note\n\nScored 7.5 High under CVSS 3.1 for consistency with the other availability advisories on this package (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), which use the same vector. The reporter self-assessed 6.9 Medium under CVSS 4.0 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`).\n\n### Credit\n\nReported by baeseungwon1010, with a working proof of concept and a proposed patch. Vector 2 was identified during maintainer verification.","status":"published","published":"2026-09-29T23:44:58Z","modified":"2026-09-30T00:00:03.836613572Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"RHSA-2026:74161","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:25:45Z","modified":"2026-10-20T10:15:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74167","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-02T10:25:47Z","modified":"2026-10-20T10:15:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74168","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:25:48Z","modified":"2026-10-20T10:15:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:84657","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-20T10:17:41Z","modified":"2026-10-20T10:43:33.48989051Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T00:01:28.043412Z","modified":"2026-10-30T00:30:02.808138726Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:04:27.805649Z","modified":"2026-10-30T12:30:02.317716363Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:96088","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-295759)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.486941765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96094","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.483801869Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96226","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)\n\n* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)\n\n* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)\n\n* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T00:04:46.01358Z","modified":"2026-11-10T00:30:02.627957336Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T00:42:40.753497Z"},{"id":"RLSA-2026:96234","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-302833)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T00:04:46.01358Z","modified":"2026-11-10T00:30:02.627933753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T00:42:40.753497Z"},{"id":"RLSA-2026:96236","title":"Important: nodejs-nodemon security update","description":"Simple monitor script for use during development of a node.js app.  For use during development of a node.js based application.  nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application.  nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word \"node\" on the command line when you run your script.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.486852715Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:98102","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)\n\n* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)\n\n* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-11T12:01:19.087268Z","modified":"2026-11-11T12:45:02.300820582Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RLSA-2026:98113","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:Rocky Linux-289618)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-11T12:01:19.087268Z","modified":"2026-11-11T12:45:02.753748007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RLSA-2026:98522","title":"Important: nodejs:26 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:26/nodejs: Rebase to the latest Node.js 26 release [rhel-9.9] (JIRA:Rocky Linux-289767)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:12.119552Z","modified":"2026-11-12T00:30:03.620223025Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"UBUNTU-CVE-2026-102276","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T21:17:00Z","modified":"2026-10-17T12:59:44.131070886Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"ALSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:30:02.511793774Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:45:02.311915713Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:96088","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.3776558Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"ALSA-2026:96094","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.399791109Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"ALSA-2026:96234","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:RHEL-302833)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T10:45:02.706366594Z","updated_at":"2026-11-10T10:57:25.458985Z"},{"id":"ALSA-2026:96236","title":"Important: nodejs-nodemon security update","description":"Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word \"node\" on the command line when you run your script.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.381735898Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"AZL-105075","title":"CVE-2026-102276 affecting package js-jquery 3.5.0-4","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T21:17:16Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"AZL-105096","title":"CVE-2026-102276 affecting package nodejs-nodemon 2.0.3-5","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T21:17:16Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"AZL-105248","title":"CVE-2026-102276 affecting package python-tensorboard 2.16.2-6","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","status":"published","published":"2026-09-28T21:17:16Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"CLSA-2026-1790807349","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 4.0.1-tuxcare.1.","status":"published","published":"2026-09-30T22:29:09Z","modified":"2026-10-15T09:47:41.963847471Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790807354","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.2-tuxcare.1.","status":"published","published":"2026-09-30T22:29:14Z","modified":"2026-10-15T09:47:41.932361453Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790807467","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.1.","status":"published","published":"2026-09-30T22:31:07Z","modified":"2026-10-15T09:47:41.93709979Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790856945","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.1.","status":"published","published":"2026-10-01T12:15:45Z","modified":"2026-10-15T09:47:41.93602876Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790863041","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.15-tuxcare.1.","status":"published","published":"2026-10-01T13:57:21Z","modified":"2026-10-15T09:47:59.984771593Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790864778","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.14-tuxcare.1.","status":"published","published":"2026-10-01T14:26:18Z","modified":"2026-10-15T09:48:04.056919737Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790887113","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.4.","status":"published","published":"2026-10-01T20:38:33Z","modified":"2026-10-15T09:48:04.067989924Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791215851","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.9-tuxcare.1.","status":"published","published":"2026-10-05T15:57:31Z","modified":"2026-10-15T09:46:51.379494364Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791215922","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.4-tuxcare.1.","status":"published","published":"2026-10-05T15:58:42Z","modified":"2026-10-15T09:47:35.576391822Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791226379","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.2.","status":"published","published":"2026-10-05T18:52:59Z","modified":"2026-10-15T09:47:35.515037707Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791226863","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.8-tuxcare.2.","status":"published","published":"2026-10-05T19:01:03Z","modified":"2026-10-15T09:47:35.584883541Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791278923","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.2-tuxcare.3.","status":"published","published":"2026-10-06T09:28:43Z","modified":"2026-10-15T09:46:51.417054885Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791626852","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.3.","status":"published","published":"2026-10-10T10:07:32Z","modified":"2026-10-25T13:43:07.933373499Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791629378","title":"TuxCare security update for brace-expansion (2 CVEs)","description":"TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 5.0.4-tuxcare.2.","status":"published","published":"2026-10-10T10:49:38Z","modified":"2026-10-15T09:47:59.8403491Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791798665","title":"TuxCare security update for brace-expansion (6 CVEs)","description":"TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.","status":"published","published":"2026-10-12T09:51:05Z","modified":"2026-10-15T09:47:40.086570225Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792233030","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.12-tuxcare.5.","status":"published","published":"2026-10-17T10:30:30Z","modified":"2026-10-25T13:43:06.302490637Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792448853","title":"TuxCare security update for brace-expansion (6 CVEs)","description":"TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.6-tuxcare.1.","status":"published","published":"2026-10-19T22:27:33Z","modified":"2026-10-20T01:45:18.158609713Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792453589","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.","status":"published","published":"2026-10-19T23:46:29Z","modified":"2026-10-20T01:45:14.461302451Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479350","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.","status":"published","published":"2026-10-20T06:55:50Z","modified":"2026-10-20T13:45:06.057962897Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793102029","title":"TuxCare security update for brace-expansion (5 CVEs)","description":"TuxCare rebuilt brace-expansion to address 5 CVEs. Fixed in 1.1.3-tuxcare.2.","status":"published","published":"2026-10-27T11:53:49Z","modified":"2026-10-27T13:30:14.88045529Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793180819","title":"TuxCare security update for brace-expansion (2 CVEs)","description":"TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.","status":"published","published":"2026-10-28T09:46:59Z","modified":"2026-10-28T13:45:16.733001854Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"openSUSE-SU-2026:12062-1","title":"pi-coding-agent-1.0.2-1.1 on GA media","description":"These are all security issues fixed in the pi-coding-agent-1.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-05T00:00:00Z","modified":"2026-10-06T17:23:10.870867704Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22111-1","title":"Security update for pi-coding-agent","description":"This update for pi-coding-agent fixes the following issues:\n\nChanges in pi-coding-agent:\n\n- Update to version 1.0.4 (1.0.3 was superseded the same day and\n  never submitted):\n  * BREAKING: provider azure-openai-responses renamed to azure,\n    now also serving Azure Foundry Chat Completions\n    (azure/deepseek-v4-pro first). Rename the provider key in\n    auth.json (or run /login again), models.json and\n    settings.json (defaultProvider, enabledModels and\n    modelThinkingLevels); sessions on the old provider fall back\n    and lose prompt cache. AZURE_OPENAI_* env vars unchanged\n  * --tools and --exclude-tools take *-patterns and --no-mcp\n    disables MCP for one run; --tools keeps MCP tools unless an\n    entry starts with mcp__\n  * Codemode read() on image files yields an image block image()\n    shows, and image() also saves each image to a temp file for\n    later turns\n  * Fix fenced-code highlighting past the first line, MCP OAuth\n    native-client registration, MCP shutdown racing a connecting\n    server, Bedrock stalled-stream retries and frozen codemode\n    built-ins, plus ChatGPT-login, EIO-on-closed-terminal and\n    output-file-permission fixes\n  * Many more fixes and improvements; see upstream's release notes\n    for the full list\n- Refresh the vendored node_modules 1.0.2 -\u003e 1.0.4: the ten\n  @earendil-works packages move to 1.0.4; nanoid, postcss and\n  vite move too but are dev-only and not shipped. Still 119\n  shipped modules and the licence union is unchanged\n  * CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above\n    the 5.0.10 fix floor, so the package is not affected by it\n  * CVE-2026-102277 (boo#1283392) and CVE-2026-102278\n    (boo#1283412): brace-expansion is 5.0.12, at the 5.0.12 and\n    above the 5.0.11 fix floors, so the package is not affected\n    by them\n\n- Update to version 1.0.2: patch releases on the 1.0 API, with no\n  breaking changes\n  * models.json takes samplingParamsByThinkingLevel next to the\n    existing samplingParams, so an OpenAI-compatible model can set\n    temperature, top_p and the like separately for off, minimal, low,\n    medium, high, xhigh and max. Model defaults, the effective level's\n    override and the request are merged per key, modelOverrides merges\n    per level, and the levels are pi's own, not the provider's\n    thinkingLevelMap values. Only openai-completions, openai-responses\n    and azure-openai-responses apply them\n  * MCP servers can be enabled, disabled or re-scoped per project\n    from a .pi/mcp.json entry without a command or url, and /mcp\n    toggles a user-level server for the current project\n  * oauth.clientRegistration: \"cimd\" identifies pi by its Client ID\n    Metadata Document instead of dynamic client registration\n  * pi.registerToolRenderer() picks how calls to a tool that is not\n    registered yet are drawn, such as MCP tools in a resumed session\n  * Cloudflare's Clef and Clef Flash classifier models are usable\n    from codemode scripts and extensions\n  * A codemode script printing in a loop now fails at 16 Mi\n    characters or 100000 items instead of running pi out of memory\n  * MCP tool calls in resumed sessions and HTML exports no longer\n    render fully expanded until their server connects\n  * JPEG, GIF and WebP images that extensions draw through Image now\n    appear in Kitty, Ghostty, WezTerm and Warp, and fullscreen Kitty\n    images no longer collapse to a one-row strip after scrolling in\n    WezTerm\n  * Many more fixes and improvements; see upstream's release notes\n    for the full list\n- Refresh the vendored node_modules over 1.0.0 -\u003e 1.0.2: the ten\n  @earendil-works packages move to 1.0.2, with pi-telemetry the one\n  that was already at 1.0.2 in the 1.0.1 tree, plus\n  @anthropic-ai/sdk to 0.129.0. No module leaves or joins the 119\n  shipped ones and the licence union is unchanged\n  * CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above\n    the 5.0.10 fix floor, so the package is not affected by it.\n    Upstream's 1.0.1 made it a direct dependency, but this package\n    vendored 5.0.12 already at 1.0.0\n  * CVE-2026-102277 (boo#1283392) and CVE-2026-102278 (boo#1283412):\n    brace-expansion is 5.0.12, at the 5.0.12 and above the 5.0.11\n    fix floors, so the package is not affected by them\n- Fix the %prep comment on Source10: upstream ships no shrinkwrap\n  since 1.0.1\n\n- Update to version 1.0.0. This is a major release with breaking\n  behaviour changes, not a patch release:\n  * BREAKING: the interactive TUI runs fullscreen by default now,\n    so the terminal's normal scrollback is gone. Set tuiMode to\n    \"regular\" in the settings, or pass --tui-mode regular, for\n    the old behaviour\n  * BREAKING: MCP OAuth credentials are keyed by server name and\n    URL instead of by URL alone, so two servers behind one URL can\n    hold separate accounts. Credentials written by 0.99.x move to\n    the first server that reads them; other servers on the same\n    URL have to sign in again\n  * BREAKING: MCP sign-in enforces RFC 9207 and rejects an\n    authorization response whose iss names another authorization\n    server. A server advertising a wrong or missing one needs the\n    new oauth.authServerMetadataUrl setting\n  * BREAKING: --provider without --model fails now instead of\n    silently running another provider's default model\n  * BREAKING: codemode scripts have to probe for a tool with\n    \"name\" in tools; typeof tools.name no longer finds it, and\n    the codemode description carries one call line per tool\n    instead of the full declaration\n  * BREAKING: quietStartup also takes \"header\", which keeps the\n    version and key hints but hides the model scope line and the\n    loaded-resource listing\n  * Sign in with Radius from /login, which can set up the Radius\n    MCP server too, and with a copy code for Anthropic when the\n    browser runs on another machine\n  * Codemode scripts call models.generateImages() to run image\n    models with the session's credentials. Codemode needs about\n    40% fewer prompt tokens and its errors now name close matches\n    and the expected argument shape\n  * MCP step-up sign-in keeps the scopes it already had, so a\n    server asking for more no longer causes a sign-in loop\n  * Fix MCP tools that tool_search loaded being dropped on resume\n    and /reload, user messages keeping two full-width copies of\n    every rendered line, and slash command completion after\n    leading whitespace\n  * Fix the memory a long assistant message keeps in the\n    transcript (about a fifth of before), colour bleeding past\n    highlights in fullscreen mode, and the system theme\n    oversaturating pastel palettes\n  * Many more fixes and improvements; see upstream's release notes\n- Refresh the vendored node_modules: the ten @earendil-works\n  packages go 0.99.2 -\u003e 1.0.0 and nothing else in the 119 shipped\n  modules moves, so the license union is unchanged. pi-agent-core\n  drops its chord, pi-telemetry, diff, ignore and yaml deps, all\n  of which other packages in the tree still pull in.\n- The codemode sandbox is still WebAssembly only (quickjs.wasm\n  plus five .so-named WASI modules, no ELF), so the package stays\n  noarch\n\n- Update to version 0.99.2:\n  * MCP servers with the default codemode exposure no longer block\n    the first prompt; they are listed in a short mcp_servers\n    system prompt section and scripts find their tools with\n    searchTools() and describeNamespace()\n  * More MCP authentication: oauth.clientName for servers that\n    only accept known OAuth clients, and \"auth\": {\"provider\": ...}\n    to send a provider's /login token to an HTTP server\n  * Anthropic workload identity federation from\n    ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID and\n    ANTHROPIC_IDENTITY_TOKEN_FILE\n  * /reload enables tools newly added to the defaultTools setting\n  * Fix codemode image() accepting malformed base64 or\n    unsupported image types, which made every later provider\n    request fail with HTTP 400\n  * Fix codemode scripts calling the wrong MCP tool when two\n    names differ only in \"-\" and \"_\"; such names now\n    normalise to \"_\"\n  * Fix new sessions intermittently ignoring the saved default\n    model, or warning that no models are available, for\n    extension-registered providers with a stored credential\n  * Fix Anthropic requests failing when a tool schema uses\n    minimum or maximum, which strict tool use rejects; such\n    tools are sent non-strict\n  * Fix provider retries firing immediately on an unparseable\n    Retry-After date, and prompt submission slowing as a\n    session grows\n  * Many more fixes and improvements; see upstream's release notes\n- Refresh the vendored node_modules: the ten @earendil-works\n  packages go 0.99.1 -\u003e 0.99.2 and nothing else in the 119\n  shipped modules moves, so the license union is unchanged\n  * CVE-2026-102277 (boo#1283392): brace-expansion is 5.0.12,\n    at the fix floor, so the package is not affected by it\n  * CVE-2026-102278 (boo#1283412): brace-expansion is 5.0.12,\n    above the 5.0.11 fix floor, so the package is not\n    affected by it\n\n- Update to version 0.99.1 (upstream jumped from 0.87.1; no\n  0.88-0.98 releases exist):\n  * Codemode and MCP: model-written JavaScript runs in a QuickJS\n    WebAssembly sandbox calling pi's tools in parallel; MCP servers\n    over stdio/HTTP with OAuth come from mcp.json and are managed\n    with /mcp and pi mcp add|remove|list|login|logout\n  * New default system theme follows the terminal's own palette,\n    with #rgb/oklch()/okhsl() colors and light/dark rebuilding\n  * Sign in with ChatGPT on the OpenAI provider; inherited OpenAI\n    Codex provider renamed \"OpenAI Codex (legacy)\"\n  * Experimental virtual models route each request to a physical\n    model; llama.cpp models gain classifier support\n  * GPT-6.1 Sol joins OpenAI, Azure OpenAI and OpenAI Codex, and\n    becomes the default Codex model\n  * Built-in extensions and tools are named builtin:\u003cname\u003e,\n    --no-extensions disables them too; tool APIs gain exposure,\n    namespaces, annotations, structuredContent, ctx.executeTool()\n  * Sessions are created on the first user message, so pi no longer\n    loses them when it exits before the first response\n  * Many more fixes and improvements; see upstream's release notes\n- Refresh package-lock.json (now the full npm-generated lockfile,\n  integrity complete) and the vendored node_modules archive:\n  116 -\u003e 119 shipped modules, with @earendil-works/pi-codemode,\n  @earendil-works/pi-mcp and quickjs-wasi new, openai 6.40.0 -\u003e\n  7.19.0 and agent-base/https-proxy-agent 7.x -\u003e 9.x; license union\n  unchanged\n- The new codemode sandbox ships as WebAssembly only (quickjs.wasm\n  plus five .so-named WASI modules, no ELF), so the package stays\n  noarch\n\n- Update to version 0.87.1:\n  * New frontier models: Claude Opus 5.5, GPT-6 Sol and Luna\n    across providers; Grok 4.7 default for xAI\n  * Fix split-turn compaction summaries refused by Claude\n    Fable 5.1; invalid --mode values now error out\n  * Undici 8.10.2 retained: the 8 CVE batch fixed since\n    0.86.1 (CVE-2026-84961, CVE-2026-85024, CVE-2026-85008,\n    CVE-2026-84947, CVE-2026-85152, CVE-2026-84890,\n    CVE-2026-84933, CVE-2026-85014; boo#1279832)\n- Refresh the vendored node_modules\n","status":"published","published":"2026-10-09T15:27:19Z","modified":"2026-10-19T17:23:14.589993257Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}