{"id":"CVE-2026-102278","aliases":["ALSA-2026:92376","ALSA-2026:92378","ALSA-2026:96088","ALSA-2026:96094","ALSA-2026:96234","ALSA-2026:96236","AZL-105078","AZL-105092","AZL-105242","CLSA-2026-1790862926","CLSA-2026-1790869539","CLSA-2026-1790876611","CLSA-2026-1790887113","CLSA-2026-1790888294","CLSA-2026-1790937659","CLSA-2026-1790968271","CLSA-2026-1791226763","CLSA-2026-1791278791","CLSA-2026-1791282853","CLSA-2026-1791282927","CLSA-2026-1791626852","CLSA-2026-1791627005","CLSA-2026-1791627107","CLSA-2026-1791798665","CLSA-2026-1791806331","CLSA-2026-1792233030","CLSA-2026-1792448853","CLSA-2026-1792453589","CLSA-2026-1792479350","CLSA-2026-1793102029","CLSA-2026-1793180819","DEBIAN-CVE-2026-102278","EUVD-2026-88555","GHSA-qhr7-859c-m2p7","RHSA-2026:73856","RHSA-2026:73914","RHSA-2026:73916","RHSA-2026:74161","RHSA-2026:74167","RHSA-2026:74168","RLSA-2026:92376","RLSA-2026:92378","RLSA-2026:96088","RLSA-2026:96094","RLSA-2026:96226","RLSA-2026:96234","RLSA-2026:96236","RLSA-2026:98102","RLSA-2026:98113","RLSA-2026:98522","UBUNTU-CVE-2026-102278","openSUSE-SU-2026:11967-1","openSUSE-SU-2026:22111-1"],"status":"published","title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00491,"percentile":0.42711,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-674"],"published":"2026-09-28T20:57:09Z","modified":"2026-11-12T00:30:03Z","fixes":[{"ecosystem":"npm","package":"brace-expansion","fixed_in":["5.0.11","3.0.8","2.1.6","1.1.20"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"brace-expansion","fixed_in":["2.0.2-tuxcare.3","1.1.18-tuxcare.3","1.1.16-tuxcare.3","1.1.15-tuxcare.3","1.1.14-tuxcare.3","5.0.10-tuxcare.1","5.0.9-tuxcare.2","5.0.8-tuxcare.3","2.1.4-tuxcare.3","2.1.2-tuxcare.5","2.1.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-brace-expansion","fixed_in":["2.1.7+~1.1.2-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","fixed_in":["0:26.10.0-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","fixed_in":["0:26.10.0-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","fixed_in":["0:26.10.0-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","fixed_in":["0:26.10.0-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","fixed_in":["0:26.10.0-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","fixed_in":["0:26.10.0-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","fixed_in":["0:11.19.1-1.26.10.0.0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","fixed_in":["0:26.10.0-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","fixed_in":["0:14.6.202.34-1.26.10.0.0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","fixed_in":["0:22.23.3-2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","fixed_in":["0:22.23.3-2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","fixed_in":["0:22.23.3-2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","fixed_in":["0:22.23.3-2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","fixed_in":["0:22.23.3-2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","fixed_in":["0:22.23.3-2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","fixed_in":["0:10.9.9-1.22.23.3.2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","fixed_in":["0:22.23.3-2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"v8-12.4-devel","fixed_in":["0:12.4.254.21-1.22.23.3.2.3.2.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","fixed_in":["0:24.21.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","fixed_in":["0:24.21.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","fixed_in":["0:24.21.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","fixed_in":["0:24.21.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","fixed_in":["0:24.21.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","fixed_in":["0:24.21.0-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","fixed_in":["0:11.19.0-1.24.21.0.1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","fixed_in":["0:11.19.0-1.24.21.0.1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","fixed_in":["0:13.6.233.17-1.24.21.0.1.1.hum1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.20"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:11.19.1-1.24.22.1.3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.9-1.22.23.4.1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.2-6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.2"}]}],"versions":["4.0.1","4.0.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.3"}]}],"versions":["2.0.2","2.0.2-tuxcare.1","2.0.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.18-tuxcare.0"},{"fixed":"1.1.18-tuxcare.3"}]}],"versions":["1.1.18","1.1.18-tuxcare.1","1.1.18-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.1-tuxcare.0"},{"fixed":"2.0.1-tuxcare.4"}]}],"versions":["2.0.1","2.0.1-tuxcare.1","2.0.1-tuxcare.2","2.0.1-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.16-tuxcare.0"},{"fixed":"1.1.16-tuxcare.3"}]}],"versions":["1.1.16","1.1.16-tuxcare.1","1.1.16-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15-tuxcare.0"},{"fixed":"1.1.15-tuxcare.3"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.14-tuxcare.0"},{"fixed":"1.1.14-tuxcare.3"}]}],"versions":["1.1.14","1.1.14-tuxcare.1","1.1.14-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.10-tuxcare.0"},{"fixed":"5.0.10-tuxcare.1"}]}],"versions":["5.0.10"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.9-tuxcare.0"},{"fixed":"5.0.9-tuxcare.2"}]}],"versions":["5.0.9","5.0.9-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.8-tuxcare.0"},{"fixed":"5.0.8-tuxcare.3"}]}],"versions":["5.0.8","5.0.8-tuxcare.1","5.0.8-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.4-tuxcare.0"},{"fixed":"2.1.4-tuxcare.3"}]}],"versions":["2.1.4","2.1.4-tuxcare.1","2.1.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.11-tuxcare.0"},{"fixed":"1.1.11-tuxcare.3"}]}],"versions":["1.1.11","1.1.11-tuxcare.1","1.1.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2-tuxcare.0"},{"fixed":"2.1.2-tuxcare.5"}]}],"versions":["2.1.2","2.1.2-tuxcare.1","2.1.2-tuxcare.2","2.1.2-tuxcare.3","2.1.2-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.3-tuxcare.0"},{"fixed":"2.1.3-tuxcare.4"}]}],"versions":["2.1.3","2.1.3-tuxcare.1","2.1.3-tuxcare.2","2.1.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5-tuxcare.0"},{"fixed":"5.0.5-tuxcare.2"}]}],"versions":["5.0.5","5.0.5-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.4-tuxcare.0"},{"fixed":"5.0.4-tuxcare.3"}]}],"versions":["5.0.4","5.0.4-tuxcare.1","5.0.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.12-tuxcare.0"},{"fixed":"1.1.12-tuxcare.5"}]}],"versions":["1.1.12","1.1.12-tuxcare.1","1.1.12-tuxcare.2","1.1.12-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.6-tuxcare.0"},{"fixed":"5.0.6-tuxcare.1"}]}],"versions":["5.0.6"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3-tuxcare.0"},{"fixed":"5.0.3-tuxcare.1"}]}],"versions":["5.0.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2-tuxcare.0"},{"fixed":"5.0.2-tuxcare.1"}]}],"versions":["5.0.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.3-tuxcare.0"},{"fixed":"1.1.3-tuxcare.2"}]}],"versions":["1.1.3","1.1.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1-tuxcare.0"},{"fixed":"1.1.1-tuxcare.1"}]}],"versions":["1.1.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2","2.0.1-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.7+~1.1.2-1"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"5.0.11"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.20"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.1-1.26.10.0.0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.10.0.0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.9-1.22.23.3.2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.254.21-1.22.23.3.2.3.2.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.6.233.17-1.24.21.0.1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.9-1.22.23.3.2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.3-2.3.2.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.21.0-1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.24.21.0.1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.6.233.17-1.24.21.0.1.2.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.1-1.26.10.0.0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.10.0-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module+el9.8.0+40401+e24b8c95"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40264+d9b257bb"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40280+057606e8"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1","1.1.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2","2.0.1+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pi-coding-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"pi-coding-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-bp160.1.1"}]}],"bundled":11}],"products":[{"vendor":"juliangruber","product":"brace-expansion"}],"references":[{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qhr7-859c-m2p7"},{"url":"https://access.redhat.com/errata/RHSA-2026:92376","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102277","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102278","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105481","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105482","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106069","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106071","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106074","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560022","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92376.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92378","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-92378.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109829","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109869","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553656","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553677","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553678","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553679","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96088.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96094","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96094.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96234","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96234.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96236","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96236.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-102278","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73856","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73856.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73914","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73914.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73916","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73916.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74161","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74161.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74167","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74167.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74168","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74168.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92376","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560022","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92378","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96088","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553679","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96094","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96226","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563978","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96226","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96234","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96236","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98102","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98102","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98113","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98113","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98522","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98522","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-102278","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102278","tags":["web"]},{"url":"https://bugzilla.suse.com/1279832","tags":["report"]},{"url":"https://bugzilla.suse.com/1283188","tags":["report"]},{"url":"https://bugzilla.suse.com/1283392","tags":["report"]},{"url":"https://bugzilla.suse.com/1283412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85152","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-102278","title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T20:57:09.85Z","modified":"2026-10-01T15:02:44.798Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T13:38:54.394896Z"}],"euvd":[{"id":"EUVD-2026-88555","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T20:57:09Z","modified":"2026-10-01T15:02:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:45.695512Z"}],"ghsa":[{"id":"GHSA-qhr7-859c-m2p7","title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","description":"### Summary\n\n`expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and crashes the process.\n\nThis is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the *tail* iterative (recursion on `m.post`, driven by how many groups are chained). Nesting depth drives a different recursion that the tail fix never touched, so the documented constant-stack-depth guarantee only ever covered chained input, not nested input.\n\nIt is also distinct from GHSA-6j4f-fj2g-mc7p, which fixed recursion in `parseCommaParts()`. Both payloads below still crash with that fix applied.\n\n### Two recursion sites\n\n**Comma members.** Each alternative of a brace set is expanded by a recursive call, so nesting a set inside every alternative recurses once per level:\n\n```js\nexpand('{a,'.repeat(4000) + 'z' + '}'.repeat(4000))\n// RangeError: Maximum call stack size exceeded\n```\n\nCrashes at depth 3,907 - about **15.6 KB** of input.\n\n**Single set.** A brace set whose body parses to a single part is expanded by a recursive call before being re-wrapped (`x{{a,b}}y` -\u003e `x{a}y x{b}y`), which recurses once per nesting level:\n\n```js\nexpand('{'.repeat(3200) + 'a,b' + '}'.repeat(3200))\n// RangeError: Maximum call stack size exceeded\n```\n\nCrashes at depth 3,125 - about **6.25 KB** of input. This is the cheapest stack-exhaustion payload known against this package: roughly a quarter the input of GHSA-6j4f-fj2g-mc7p (29 KB), and about a tenth of minimatch's `MAX_PATTERN_LENGTH` (65,536).\n\n### Why `max` and `maxLength` do not help\n\nBoth crashes happen while recursing into sub-expansions, before the result set grows. The payloads produce almost no output - the single-set case yields 2 results - so neither bound is ever the limiter. `expand(payload, { max: 1, maxLength: 1 })` still overflows.\n\n### Impact\n\nAny application passing an untrusted string to `expand()`, directly or through `minimatch` / `glob` as a user-supplied glob pattern, can be crashed. In Node a `RangeError` the application does not catch terminates the process, so a server globbing user input is exposed to remote unauthenticated denial of service.\n\nAvailability only. No code execution, no data exposure.\n\n### Affected versions\n\nVerified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, at near-identical depths on every line (single set: 3,125 on all four; comma members: 3,907-4,102). Not a regression from any recent fix - the gap predates them.\n\n### Patch\n\nA `maxDepth` bound (default `EXPANSION_MAX_DEPTH`) is threaded through `expand_()`. Past the cap a group is treated as non-expanding and returned literally, which is how the parser already handles a group that cannot expand. This matches the existing `max` / `maxLength` caps, which truncate rather than throw, so `expand()` continues never to throw on any input.\n\nThe default sits far above any realistic nesting depth and well below the crash threshold.","status":"published","published":"2026-09-29T23:45:17Z","modified":"2026-09-29T23:45:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-102278","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T21:17:16.517Z","modified":"2026-10-01T15:17:25.593Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T14:12:52.413234Z"}],"osv":[{"id":"CVE-2026-102278","title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T20:57:09.85Z","modified":"2026-11-10T12:12:22.97371276Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-10T11:27:53.954741Z"},{"id":"DEBIAN-CVE-2026-102278","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T21:17:16.517Z","modified":"2026-10-09T17:00:11.449249015Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-qhr7-859c-m2p7","title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","description":"### Summary\n\n`expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and crashes the process.\n\nThis is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the *tail* iterative (recursion on `m.post`, driven by how many groups are chained). Nesting depth drives a different recursion that the tail fix never touched, so the documented constant-stack-depth guarantee only ever covered chained input, not nested input.\n\nIt is also distinct from GHSA-6j4f-fj2g-mc7p, which fixed recursion in `parseCommaParts()`. Both payloads below still crash with that fix applied.\n\n### Two recursion sites\n\n**Comma members.** Each alternative of a brace set is expanded by a recursive call, so nesting a set inside every alternative recurses once per level:\n\n```js\nexpand('{a,'.repeat(4000) + 'z' + '}'.repeat(4000))\n// RangeError: Maximum call stack size exceeded\n```\n\nCrashes at depth 3,907 - about **15.6 KB** of input.\n\n**Single set.** A brace set whose body parses to a single part is expanded by a recursive call before being re-wrapped (`x{{a,b}}y` -\u003e `x{a}y x{b}y`), which recurses once per nesting level:\n\n```js\nexpand('{'.repeat(3200) + 'a,b' + '}'.repeat(3200))\n// RangeError: Maximum call stack size exceeded\n```\n\nCrashes at depth 3,125 - about **6.25 KB** of input. This is the cheapest stack-exhaustion payload known against this package: roughly a quarter the input of GHSA-6j4f-fj2g-mc7p (29 KB), and about a tenth of minimatch's `MAX_PATTERN_LENGTH` (65,536).\n\n### Why `max` and `maxLength` do not help\n\nBoth crashes happen while recursing into sub-expansions, before the result set grows. The payloads produce almost no output - the single-set case yields 2 results - so neither bound is ever the limiter. `expand(payload, { max: 1, maxLength: 1 })` still overflows.\n\n### Impact\n\nAny application passing an untrusted string to `expand()`, directly or through `minimatch` / `glob` as a user-supplied glob pattern, can be crashed. In Node a `RangeError` the application does not catch terminates the process, so a server globbing user input is exposed to remote unauthenticated denial of service.\n\nAvailability only. No code execution, no data exposure.\n\n### Affected versions\n\nVerified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, at near-identical depths on every line (single set: 3,125 on all four; comma members: 3,907-4,102). Not a regression from any recent fix - the gap predates them.\n\n### Patch\n\nA `maxDepth` bound (default `EXPANSION_MAX_DEPTH`) is threaded through `expand_()`. Past the cap a group is treated as non-expanding and returned literally, which is how the parser already handles a group that cannot expand. This matches the existing `max` / `maxLength` caps, which truncate rather than throw, so `expand()` continues never to throw on any input.\n\nThe default sits far above any realistic nesting depth and well below the crash threshold.","status":"published","published":"2026-09-29T23:45:17Z","modified":"2026-09-30T00:00:04.402763332Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"RHSA-2026:73856","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-01T10:21:06Z","modified":"2026-10-17T10:19:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:73914","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-01T10:21:07Z","modified":"2026-10-17T10:19:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:73916","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-01T10:21:08Z","modified":"2026-10-17T10:19:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74161","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:25:45Z","modified":"2026-10-20T10:15:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74167","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-02T10:25:47Z","modified":"2026-10-20T10:15:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74168","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-02T10:25:48Z","modified":"2026-10-20T10:15:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T00:01:28.043412Z","modified":"2026-10-30T00:30:02.808138726Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:04:27.805649Z","modified":"2026-10-30T12:30:02.317716363Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:96088","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-295759)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.486941765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96094","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.483801869Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96226","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)\n\n* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)\n\n* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)\n\n* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T00:04:46.01358Z","modified":"2026-11-10T00:30:02.627957336Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T00:42:40.753497Z"},{"id":"RLSA-2026:96234","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-302833)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T00:04:46.01358Z","modified":"2026-11-10T00:30:02.627933753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T00:42:40.753497Z"},{"id":"RLSA-2026:96236","title":"Important: nodejs-nodemon security update","description":"Simple monitor script for use during development of a node.js app.  For use during development of a node.js based application.  nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application.  nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word \"node\" on the command line when you run your script.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.486852715Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:98102","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)\n\n* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)\n\n* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-11T12:01:19.087268Z","modified":"2026-11-11T12:45:02.300820582Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RLSA-2026:98113","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:Rocky Linux-289618)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-11T12:01:19.087268Z","modified":"2026-11-11T12:45:02.753748007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RLSA-2026:98522","title":"Important: nodejs:26 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:26/nodejs: Rebase to the latest Node.js 26 release [rhel-9.9] (JIRA:Rocky Linux-289767)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:12.119552Z","modified":"2026-11-12T00:30:03.620223025Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"UBUNTU-CVE-2026-102278","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T21:17:00Z","modified":"2026-10-17T12:59:46.317642015Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"ALSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:30:02.511793774Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:45:02.311915713Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:96088","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.3776558Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"ALSA-2026:96094","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.399791109Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"ALSA-2026:96234","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:RHEL-302833)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T10:45:02.706366594Z","updated_at":"2026-11-10T10:57:25.458985Z"},{"id":"ALSA-2026:96236","title":"Important: nodejs-nodemon security update","description":"Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word \"node\" on the command line when you run your script.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.381735898Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"AZL-105078","title":"CVE-2026-102278 affecting package js-jquery 3.5.0-4","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T21:17:16Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"AZL-105092","title":"CVE-2026-102278 affecting package nodejs-nodemon 2.0.3-5","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T21:17:16Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"AZL-105242","title":"CVE-2026-102278 affecting package python-tensorboard 2.16.2-6","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","status":"published","published":"2026-09-28T21:17:16Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"CLSA-2026-1790862926","title":"TuxCare security update for brace-expansion (2 CVEs)","description":"TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 4.0.1-tuxcare.2.","status":"published","published":"2026-10-01T13:55:26Z","modified":"2026-10-15T09:47:59.915719233Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790869539","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.2-tuxcare.3.","status":"published","published":"2026-10-01T15:45:39Z","modified":"2026-10-15T09:48:04.345104255Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790876611","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.3.","status":"published","published":"2026-10-01T17:43:31Z","modified":"2026-10-15T09:48:04.329665533Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790887113","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.4.","status":"published","published":"2026-10-01T20:38:33Z","modified":"2026-10-15T09:48:04.067989924Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790888294","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.3.","status":"published","published":"2026-10-01T20:58:14Z","modified":"2026-10-15T09:47:57.853055901Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790937659","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.15-tuxcare.3.","status":"published","published":"2026-10-02T10:40:59Z","modified":"2026-10-15T09:47:38.607518926Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1790968271","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.14-tuxcare.3.","status":"published","published":"2026-10-02T19:11:11Z","modified":"2026-10-15T09:47:57.919283294Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791226763","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.10-tuxcare.1.","status":"published","published":"2026-10-05T18:59:23Z","modified":"2026-10-15T09:47:35.550302762Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791278791","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.9-tuxcare.2.","status":"published","published":"2026-10-06T09:26:31Z","modified":"2026-10-15T09:47:35.543113885Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791282853","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.8-tuxcare.3.","status":"published","published":"2026-10-06T10:34:13Z","modified":"2026-10-15T09:46:45.713488797Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791282927","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.4-tuxcare.3.","status":"published","published":"2026-10-06T10:35:27Z","modified":"2026-10-15T09:47:35.51242088Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791626852","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.3.","status":"published","published":"2026-10-10T10:07:32Z","modified":"2026-10-25T13:43:07.933373499Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791627005","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.2-tuxcare.5.","status":"published","published":"2026-10-10T10:10:05Z","modified":"2026-10-15T09:48:04.627700379Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791627107","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.4.","status":"published","published":"2026-10-10T10:11:47Z","modified":"2026-10-15T09:48:04.468435678Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791798665","title":"TuxCare security update for brace-expansion (6 CVEs)","description":"TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.","status":"published","published":"2026-10-12T09:51:05Z","modified":"2026-10-15T09:47:40.086570225Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806331","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3.","status":"published","published":"2026-10-12T11:58:51Z","modified":"2026-10-15T09:47:40.04747697Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792233030","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.12-tuxcare.5.","status":"published","published":"2026-10-17T10:30:30Z","modified":"2026-10-25T13:43:06.302490637Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792448853","title":"TuxCare security update for brace-expansion (6 CVEs)","description":"TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.6-tuxcare.1.","status":"published","published":"2026-10-19T22:27:33Z","modified":"2026-10-20T01:45:18.158609713Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792453589","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.","status":"published","published":"2026-10-19T23:46:29Z","modified":"2026-10-20T01:45:14.461302451Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479350","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.","status":"published","published":"2026-10-20T06:55:50Z","modified":"2026-10-20T13:45:06.057962897Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793102029","title":"TuxCare security update for brace-expansion (5 CVEs)","description":"TuxCare rebuilt brace-expansion to address 5 CVEs. Fixed in 1.1.3-tuxcare.2.","status":"published","published":"2026-10-27T11:53:49Z","modified":"2026-10-27T13:30:14.88045529Z","updated_at":"2026-11-02T15:43:55.34846Z"}]},"sources_more":{"osv":3}}