{"id":"CVE-2026-13149","aliases":["ALSA-2026:47057","ALSA-2026:47058","ALSA-2026:47059","ALSA-2026:47060","ALSA-2026:48032","ALSA-2026:48033","ALSA-2026:48034","CLSA-2026-1784596285","CLSA-2026-1791626852","CLSA-2026-1791798665","CLSA-2026-1791806331","CLSA-2026-1792232943","CLSA-2026-1792233030","CLSA-2026-1792233116","CLSA-2026-1792233308","CLSA-2026-1792243228","CLSA-2026-1792448853","CLSA-2026-1792453589","CLSA-2026-1792479350","CLSA-2026-1793808172","DEBIAN-CVE-2026-13149","EUVD-2026-40269","GHSA-3jxr-9vmj-r5cp","RHSA-2026:33866","RHSA-2026:34478","RHSA-2026:35272","RHSA-2026:45360","RHSA-2026:47057","RHSA-2026:47058","RHSA-2026:47059","RHSA-2026:47060","RHSA-2026:48032","RHSA-2026:48033","RHSA-2026:48034","RHSA-2026:52394","RHSA-2026:52399","RHSA-2026:52990","RHSA-2026:53298","RHSA-2026:57590","RLSA-2026:47057","RLSA-2026:47058","RLSA-2026:47059","RLSA-2026:47060","RLSA-2026:48032","RLSA-2026:48033","RLSA-2026:48034","ROOT-APP-NPM-CVE-2026-13149","SUSE-SU-2026:3713-1","SUSE-SU-2026:3714-1","UBUNTU-CVE-2026-13149","openSUSE-SU-2026:11220-1","openSUSE-SU-2026:11452-1","openSUSE-SU-2026:11680-1","openSUSE-SU-2026:21312-1","openSUSE-SU-2026:21448-1"],"status":"published","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00364,"percentile":0.30609,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2026-06-30T08:30:34Z","modified":"2026-11-10T17:23:21Z","fixes":[{"ecosystem":"npm","package":"brace-expansion","fixed_in":["5.0.7","1.1.16","2.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:10","package":"nodejs-nodemon","fixed_in":["3.1.14-2.el10_2"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"brace-expansion","fixed_in":["2.0.1-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-nodemon","fixed_in":["0:3.1.14-2.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-nodemon","fixed_in":["0:3.1.14-2.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"nodejs-nodemon","fixed_in":["0:3.1.14-2.el10_2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"brace-expansion","fixed_in":["5.0.7-aikido.3","2.0.1-aikido.4","2.0.2-aikido.3","1.1.12-aikido.3","2.0.3-aikido.1","1.1.14-aikido.1","2.1.1-aikido.1","1.1.13-aikido.1","5.0.6-aikido.1","2.1.0-aikido.1","1.1.15-aikido.1","5.0.5-aikido.2","1.1.11-aikido.4","1.1.15-aikido.2","1.1.14-aikido.2","2.1.0-aikido.2","5.0.5-aikido.3","5.0.6-aikido.2","2.0.3-aikido.2","1.1.11-aikido.5","2.1.1-aikido.2","1.1.13-aikido.2","1.1.12-aikido.4","2.1.1-aikido.3","2.0.3-aikido.3","1.1.11-aikido.6","5.0.5-aikido.4","2.0.1-aikido.5","5.0.6-aikido.3","2.0.2-aikido.4","1.1.15-aikido.3","1.1.13-aikido.3","5.0.4-aikido.3","5.0.4-aikido.4","2.1.0-aikido.3","5.0.4-aikido.5","1.1.14-aikido.3","1.1.15-aikido.4","5.0.6-aikido.4","2.1.0-aikido.4","5.0.3-aikido.5","5.0.6-aikido.5","5.0.6-aikido.6","2.0.1-aikido.6","1.1.12-aikido.5","1.1.13-aikido.4","1.1.12-aikido.6","1.1.13-aikido.5","2.0.1-aikido.7","1.1.14-aikido.4","1.1.11-aikido.7","1.1.14-aikido.5","5.0.7-aikido.4","2.0.2-aikido.5","2.0.2-aikido.6","2.1.0-aikido.5","5.0.5-aikido.5","5.0.3-aikido.6","1.1.16-aikido.1","2.1.2-aikido.1","5.0.7-aikido.1","2.1.2-aikido.2","1.1.16-aikido.2","5.0.7-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/brace-expansion","fixed_in":["5.0.7-root.io.3","2.0.1-root.io.4","2.0.2-root.io.3","1.1.12-root.io.3","2.0.3-root.io.1","1.1.14-root.io.1","2.1.1-root.io.1","1.1.13-root.io.1","5.0.6-root.io.1","2.1.0-root.io.1","1.1.15-root.io.1","5.0.5-root.io.2","1.1.11-root.io.4","1.1.15-root.io.2","1.1.14-root.io.2","2.1.0-root.io.2","5.0.5-root.io.3","5.0.6-root.io.2","2.0.3-root.io.2","1.1.11-root.io.5","2.1.1-root.io.2","1.1.13-root.io.2","1.1.12-root.io.4","2.1.1-root.io.3","2.0.3-root.io.3","1.1.11-root.io.6","5.0.5-root.io.4","2.0.1-root.io.5","5.0.6-root.io.3","2.0.2-root.io.4","1.1.15-root.io.3","1.1.13-root.io.3","5.0.4-root.io.3","5.0.4-root.io.4","2.1.0-root.io.3","5.0.4-root.io.5","1.1.14-root.io.3","1.1.15-root.io.4","5.0.6-root.io.4","2.1.0-root.io.4","5.0.3-root.io.5","5.0.6-root.io.5","5.0.6-root.io.6","2.0.1-root.io.6","1.1.12-root.io.5","1.1.13-root.io.4","1.1.12-root.io.6","1.1.13-root.io.5","2.0.1-root.io.7","1.1.14-root.io.4","1.1.11-root.io.7","1.1.14-root.io.5","5.0.7-root.io.4","2.0.2-root.io.5","2.0.2-root.io.6","2.1.0-root.io.5","5.0.5-root.io.5","5.0.3-root.io.6","1.1.16-root.io.1","2.1.2-root.io.1","5.0.7-root.io.1","2.1.2-root.io.2","1.1.16-root.io.2","5.0.7-root.io.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-pytest-html","fixed_in":["4.1.1-bp160.4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.0.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el9.8.0+286+9023ffdb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el9.8.0+286+9023ffdb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el9.8.0+286+9023ffdb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el9.8.0+286+9023ffdb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el9.8.0+286+9023ffdb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el9.8.0+286+9023ffdb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.3.module_el9.8.0+286+9023ffdb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.18.0.3.module_el9.8.0+286+9023ffdb"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el9.8.0+285+5c3b0251"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el9.8.0+285+5c3b0251"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el9.8.0+285+5c3b0251"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el9.8.0+285+5c3b0251"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el9.8.0+285+5c3b0251"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-1.module_el9.8.0+285+5c3b0251"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.2.module_el9.8.0+285+5c3b0251"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el8.10.0+4236+04bc75d9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el8.10.0+4236+04bc75d9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el8.10.0+4236+04bc75d9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el8.10.0+4236+04bc75d9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module_el8.10.0+4236+04bc75d9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-1.module_el8.10.0+4236+04bc75d9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.2.module_el8.10.0+4236+04bc75d9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.2.module_el8.10.0+4236+04bc75d9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module_el8.10.0+4237+cde4efc3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module_el8.10.0+4237+cde4efc3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module_el8.10.0+4237+cde4efc3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module_el8.10.0+4237+cde4efc3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module_el8.10.0+4237+cde4efc3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-1.module_el8.10.0+4237+cde4efc3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.2.module_el8.10.0+4237+cde4efc3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.18.0.2.module_el8.10.0+4237+cde4efc3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.1-tuxcare.0"},{"fixed":"2.0.1-tuxcare.2"}]}],"versions":["2.0.1","2.0.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.11-tuxcare.0"},{"fixed":"1.1.11-tuxcare.3"}]}],"versions":["1.1.11","1.1.11-tuxcare.1","1.1.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5-tuxcare.0"},{"fixed":"5.0.5-tuxcare.2"}]}],"versions":["5.0.5","5.0.5-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.4-tuxcare.0"},{"fixed":"5.0.4-tuxcare.3"}]}],"versions":["5.0.4","5.0.4-tuxcare.1","5.0.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.14-tuxcare.0"},{"fixed":"1.1.14-tuxcare.4"}]}],"versions":["1.1.14","1.1.14-tuxcare.1","1.1.14-tuxcare.2","1.1.14-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.12-tuxcare.0"},{"fixed":"1.1.12-tuxcare.5"}]}],"versions":["1.1.12","1.1.12-tuxcare.1","1.1.12-tuxcare.2","1.1.12-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15-tuxcare.0"},{"fixed":"1.1.15-tuxcare.4"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2","1.1.15-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.3"}]}],"versions":["4.0.1","4.0.1-tuxcare.1","4.0.1-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.4"}]}],"versions":["2.0.2","2.0.2-tuxcare.1","2.0.2-tuxcare.2","2.0.2-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.6-tuxcare.0"},{"fixed":"5.0.6-tuxcare.1"}]}],"versions":["5.0.6"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3-tuxcare.0"},{"fixed":"5.0.3-tuxcare.1"}]}],"versions":["5.0.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2-tuxcare.0"},{"fixed":"5.0.2-tuxcare.1"}]}],"versions":["5.0.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.3-tuxcare.0"},{"fixed":"1.1.3-tuxcare.3"}]}],"versions":["1.1.3","1.1.3-tuxcare.1","1.1.3-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2","2.0.1-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"5.0.7"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.16"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.17.0-1.26.4.0.1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.4.0.1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.0.0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.6.233.17-1.24.18.0.0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.8-1.22.23.1.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.17.0-1.26.5.0.1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.5.0.1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+24539+0ea88729"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24355+35d95b59"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24355+35d95b59"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.18.0.3.module+el9.8.0+24537+83ec84e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-1.module+el9.8.0+24540+c30b2ffe"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24156+bb41d456"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24156+bb41d456"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.2.module+el9.8.0+24538+3f176d52"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-1.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24500+8eb51621"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24500+8eb51621"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.2.module+el8.10.0+24556+e9352af2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-1.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.18.0.2.module+el8.10.0+24562+090c6525"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-1.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.26.7.0.1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.7.0.1.5.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rh-podman-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.2-1.el10_2"}]}],"bundled":24},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el9.8.0+40264+d9b257bb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40264+d9b257bb"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.module+el9.8.0+40263+faa47049"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-1.module+el9.8.0+40263+faa47049"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-4.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7-aikido.3"},{"fixed":"2.0.1-aikido.4"},{"fixed":"2.0.2-aikido.3"},{"fixed":"1.1.12-aikido.3"},{"fixed":"2.0.3-aikido.1"},{"fixed":"1.1.14-aikido.1"},{"fixed":"2.1.1-aikido.1"},{"fixed":"1.1.13-aikido.1"},{"fixed":"5.0.6-aikido.1"},{"fixed":"2.1.0-aikido.1"},{"fixed":"1.1.15-aikido.1"},{"fixed":"5.0.5-aikido.2"},{"fixed":"1.1.11-aikido.4"},{"fixed":"1.1.15-aikido.2"},{"fixed":"1.1.14-aikido.2"},{"fixed":"2.1.0-aikido.2"},{"fixed":"5.0.5-aikido.3"},{"fixed":"5.0.6-aikido.2"},{"fixed":"2.0.3-aikido.2"},{"fixed":"1.1.11-aikido.5"},{"fixed":"2.1.1-aikido.2"},{"fixed":"1.1.13-aikido.2"},{"fixed":"1.1.12-aikido.4"},{"fixed":"2.1.1-aikido.3"},{"fixed":"2.0.3-aikido.3"},{"fixed":"1.1.11-aikido.6"},{"fixed":"5.0.5-aikido.4"},{"fixed":"2.0.1-aikido.5"},{"fixed":"5.0.6-aikido.3"},{"fixed":"2.0.2-aikido.4"},{"fixed":"1.1.15-aikido.3"},{"fixed":"1.1.13-aikido.3"},{"fixed":"5.0.4-aikido.3"},{"fixed":"5.0.4-aikido.4"},{"fixed":"2.1.0-aikido.3"},{"fixed":"5.0.4-aikido.5"},{"fixed":"1.1.14-aikido.3"},{"fixed":"1.1.15-aikido.4"},{"fixed":"5.0.6-aikido.4"},{"fixed":"2.1.0-aikido.4"},{"fixed":"5.0.3-aikido.5"},{"fixed":"5.0.6-aikido.5"},{"fixed":"5.0.6-aikido.6"},{"fixed":"2.0.1-aikido.6"},{"fixed":"1.1.12-aikido.5"},{"fixed":"1.1.13-aikido.4"},{"fixed":"1.1.12-aikido.6"},{"fixed":"1.1.13-aikido.5"},{"fixed":"2.0.1-aikido.7"},{"fixed":"1.1.14-aikido.4"},{"fixed":"1.1.11-aikido.7"},{"fixed":"1.1.14-aikido.5"},{"fixed":"5.0.7-aikido.4"},{"fixed":"2.0.2-aikido.5"},{"fixed":"2.0.2-aikido.6"},{"fixed":"2.1.0-aikido.5"},{"fixed":"5.0.5-aikido.5"},{"fixed":"5.0.3-aikido.6"},{"fixed":"1.1.16-aikido.1"},{"fixed":"2.1.2-aikido.1"},{"fixed":"5.0.7-aikido.1"},{"fixed":"2.1.2-aikido.2"},{"fixed":"1.1.16-aikido.2"},{"fixed":"5.0.7-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7-root.io.3"},{"fixed":"2.0.1-root.io.4"},{"fixed":"2.0.2-root.io.3"},{"fixed":"1.1.12-root.io.3"},{"fixed":"2.0.3-root.io.1"},{"fixed":"1.1.14-root.io.1"},{"fixed":"2.1.1-root.io.1"},{"fixed":"1.1.13-root.io.1"},{"fixed":"5.0.6-root.io.1"},{"fixed":"2.1.0-root.io.1"},{"fixed":"1.1.15-root.io.1"},{"fixed":"5.0.5-root.io.2"},{"fixed":"1.1.11-root.io.4"},{"fixed":"1.1.15-root.io.2"},{"fixed":"1.1.14-root.io.2"},{"fixed":"2.1.0-root.io.2"},{"fixed":"5.0.5-root.io.3"},{"fixed":"5.0.6-root.io.2"},{"fixed":"2.0.3-root.io.2"},{"fixed":"1.1.11-root.io.5"},{"fixed":"2.1.1-root.io.2"},{"fixed":"1.1.13-root.io.2"},{"fixed":"1.1.12-root.io.4"},{"fixed":"2.1.1-root.io.3"},{"fixed":"2.0.3-root.io.3"},{"fixed":"1.1.11-root.io.6"},{"fixed":"5.0.5-root.io.4"},{"fixed":"2.0.1-root.io.5"},{"fixed":"5.0.6-root.io.3"},{"fixed":"2.0.2-root.io.4"},{"fixed":"1.1.15-root.io.3"},{"fixed":"1.1.13-root.io.3"},{"fixed":"5.0.4-root.io.3"},{"fixed":"5.0.4-root.io.4"},{"fixed":"2.1.0-root.io.3"},{"fixed":"5.0.4-root.io.5"},{"fixed":"1.1.14-root.io.3"},{"fixed":"1.1.15-root.io.4"},{"fixed":"5.0.6-root.io.4"},{"fixed":"2.1.0-root.io.4"},{"fixed":"5.0.3-root.io.5"},{"fixed":"5.0.6-root.io.5"},{"fixed":"5.0.6-root.io.6"},{"fixed":"2.0.1-root.io.6"},{"fixed":"1.1.12-root.io.5"},{"fixed":"1.1.13-root.io.4"},{"fixed":"1.1.12-root.io.6"},{"fixed":"1.1.13-root.io.5"},{"fixed":"2.0.1-root.io.7"},{"fixed":"1.1.14-root.io.4"},{"fixed":"1.1.11-root.io.7"},{"fixed":"1.1.14-root.io.5"},{"fixed":"5.0.7-root.io.4"},{"fixed":"2.0.2-root.io.5"},{"fixed":"2.0.2-root.io.6"},{"fixed":"2.1.0-root.io.5"},{"fixed":"5.0.5-root.io.5"},{"fixed":"5.0.3-root.io.6"},{"fixed":"1.1.16-root.io.1"},{"fixed":"2.1.2-root.io.1"},{"fixed":"5.0.7-root.io.1"},{"fixed":"2.1.2-root.io.2"},{"fixed":"1.1.16-root.io.2"},{"fixed":"5.0.7-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150002.4.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150002.3.16.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150002.4.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.34.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150000.3.75.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150000.1.98.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.34.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150100.4.37.2"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1","1.1.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2","2.0.1+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pytest-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-integration-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1785848065.5562c7c-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24+0.a836cced5-52.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-pytest-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-bp160.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17+673.b97ba64d6-160000.12.1"}]}],"bundled":13}],"products":[{"vendor":"juliangruber","product":"brace-expansion"}],"references":[{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["fix","web","article","report"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/pull/122","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/pull/123","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp"},{"url":"https://access.redhat.com/errata/RHSA-2026:47057","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59873","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59874","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494813","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498116","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498120","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-47057.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47058","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-47058.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47059","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-47059.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47060","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-47060.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48032","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-48032.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48033","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-48033.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48034","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-48034.html","tags":["advisory"]},{"url":"https://registry.npmjs.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13149.json","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["package","article"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-13149","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33866","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53550","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48936","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48934","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48928","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48930","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48619","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48935","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33866.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48619","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48928","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48930","tags":["advisory"]},{"url":"https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e","tags":["article"]},{"url":"https://hackerone.com/reports/3656716","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48934","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48935","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48936","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491401","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34478","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34478.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35272","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35272.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:45360","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14257","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45360.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498120","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47057.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.19","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47058.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47059.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47060.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48032.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48033.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48034.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52394","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52394.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52399","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493337","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52399.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12151","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42338","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48615","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48615","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48617","tags":["advisory"]},{"url":"http://hackerone.com/reports/3692858","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48618","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48618","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48931","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48933","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48937","tags":["advisory"]},{"url":"https://hackerone.com/reports/3658225","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52990","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58044","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58042","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58041","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52990.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58041","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510854","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58042","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58044","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58045","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53298","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53298.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510801","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-238929","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595","tags":["advisory"]},{"url":"https://github.com/facebook/create-react-app/pull/7444","tags":["article"]},{"url":"https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/pull/4316","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","tags":["advisory"]},{"url":"https://cwe.mitre.org/data/definitions/93.html","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","tags":["article"]},{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","tags":["article"]},{"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","tags":["article"]},{"url":"https://www.npmjs.com/package/form-data","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","tags":["article"]},{"url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42570","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.8.1","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","tags":["advisory"]},{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45740","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48068","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","tags":["advisory"]},{"url":"https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","tags":["article"]},{"url":"https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.7","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56876","tags":["advisory"]},{"url":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","tags":["article"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59877","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/pull/2352","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47057","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47058","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47059","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47060","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:48032","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:48033","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:48034","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263713-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263272","tags":["report"]},{"url":"https://bugzilla.suse.com/1265827","tags":["report"]},{"url":"https://bugzilla.suse.com/1266615","tags":["report"]},{"url":"https://bugzilla.suse.com/1267416","tags":["report"]},{"url":"https://bugzilla.suse.com/1269917","tags":["report"]},{"url":"https://bugzilla.suse.com/1271327","tags":["report"]},{"url":"https://bugzilla.suse.com/1271331","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263714-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-13149","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://bugzilla.suse.com/1269923","tags":["report"]},{"url":"https://bugzilla.suse.com/1246822","tags":["report"]},{"url":"https://bugzilla.suse.com/1259169","tags":["report"]},{"url":"https://bugzilla.suse.com/1268851","tags":["report"]},{"url":"https://bugzilla.suse.com/1269359","tags":["report"]},{"url":"https://bugzilla.suse.com/1269514","tags":["report"]},{"url":"https://bugzilla.suse.com/1269595","tags":["report"]},{"url":"https://bugzilla.suse.com/1269927","tags":["report"]},{"url":"https://bugzilla.suse.com/1272310","tags":["report"]},{"url":"https://bugzilla.suse.com/1272311","tags":["report"]},{"url":"https://bugzilla.suse.com/1272312","tags":["report"]},{"url":"https://bugzilla.suse.com/1272313","tags":["report"]},{"url":"https://bugzilla.suse.com/1272317","tags":["report"]},{"url":"https://bugzilla.suse.com/1272318","tags":["report"]},{"url":"https://bugzilla.suse.com/1272319","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54490","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-13149","description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","status":"published","published":"2026-06-30T08:30:34.502Z","modified":"2026-07-08T11:38:35.974Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-40269","description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","status":"published","published":"2026-06-30T08:30:34Z","modified":"2026-07-08T11:38:35Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high"}],"updated_at":"2026-11-02T18:20:11.442824Z"}],"ghsa":[{"id":"GHSA-3jxr-9vmj-r5cp","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","description":"### Summary\nbrace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, all-ASCII input (~90 bytes/30 groups) blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitely. Because the dominant consumers run on Node's single-threaded event loop, one small input can fully stall a worker/process.\n\nIn `expand_`, `post` is computed unconditionally at the top of the function, before the early-return branches that don't use it:\n```js\nconst post = m.post.length ? expand_(m.post, max, false) : [''];   // always recurses\n  ...\nif (!isSequence \u0026\u0026 !isOptions) {\n  if (m.post.match(/,(?!,).*\\}/)) {\n    str = m.pre + '{' + m.body + escClose + m.post;\n    return expand_(str, max, true); // restart — `post` discarded\n  }\n  return [str];\n}\n```\n\nFor input like a{},{},…, the first {} is non-expanding, so control reaches the {a},b} rewrite branch - but `expand_` has already recursed into post over the entire remaining tail, only to throw the result away.\nEach level therefore spawns two recursive expansions over essentially the same remaining work: `T(n) = 2·T(n−1) ⇒ O(2ⁿ)`.\n\nThe max option does not mitigate this: max only bounds the output-building loops; neither the post recursion nor the rewrite recursion consults it.\n  \nMeasured on 5.0.6:\n\n| groups (n) | input bytes | time |\n|---|---|---|\n| 20 | 60 | 130 ms |\n| 24 | 72 | 1.9 s |\n| 26 | 78 | 7.8 s |\n| 30 (PoC) | 90 | ~2 min |\n\n### Proof of concept\n```js\nconst { expand } = require('brace-expansion');\n// 30 non-expanding groups, ~90 bytes — blocks for minutes:\nexpand('a{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{}');\n```\n\n### Impact\n\nAny application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch/glob brace patterns - can be driven into a multi-minute-to-indefinite CPU hang by a tiny request, denying service on that thread/process.\n\n### Remediation\n\nUpgrade to a patched release. The fix:\n1. Defers computing post until after the early-return branches (and computes it locally in the $-suffix branch), so post is only expanded when a brace set actually expands and the value is used. This alone removes the exponential.\n1. Converts the {a},b} rewrite from recursion to an in-function loop, so a long run of rewrites cannot grow the call stack.\n\nVerified: the PoC drops from ~2 min to 0.55 ms, 5,000 groups complete in ~344 ms, and output is identical to 5.0.6 across a behavioral-equivalence suite (sequences, padding, $-prefix, a{},b}c, {},a}b, x{{a,b}}y, etc.). Post-fix complexity is ~O(n²) on this input class - acceptable for the security fix; a linear rewrite can be a non-urgent follow-up.\n\nIf immediate upgrade isn't possible, avoid passing untrusted input to expand() / glob brace patterns, or run such expansion under a timeout/worker.","status":"published","published":"2026-07-20T20:51:09Z","modified":"2026-07-20T20:51:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:40:47.245721Z"}],"nvd":[{"id":"CVE-2026-13149","description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","status":"published","published":"2026-06-30T10:16:34.56Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"CVE-2026-13149","description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","status":"published","published":"2026-06-30T08:30:34.502Z","modified":"2026-10-28T02:30:23.94141023Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-13149","description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","status":"published","published":"2026-06-30T10:16:34.56Z","modified":"2026-10-26T12:01:57.553924014Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"GHSA-3jxr-9vmj-r5cp","title":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","description":"### Summary\nbrace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, all-ASCII input (~90 bytes/30 groups) blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitely. Because the dominant consumers run on Node's single-threaded event loop, one small input can fully stall a worker/process.\n\nIn `expand_`, `post` is computed unconditionally at the top of the function, before the early-return branches that don't use it:\n```js\nconst post = m.post.length ? expand_(m.post, max, false) : [''];   // always recurses\n  ...\nif (!isSequence \u0026\u0026 !isOptions) {\n  if (m.post.match(/,(?!,).*\\}/)) {\n    str = m.pre + '{' + m.body + escClose + m.post;\n    return expand_(str, max, true); // restart — `post` discarded\n  }\n  return [str];\n}\n```\n\nFor input like a{},{},…, the first {} is non-expanding, so control reaches the {a},b} rewrite branch - but `expand_` has already recursed into post over the entire remaining tail, only to throw the result away.\nEach level therefore spawns two recursive expansions over essentially the same remaining work: `T(n) = 2·T(n−1) ⇒ O(2ⁿ)`.\n\nThe max option does not mitigate this: max only bounds the output-building loops; neither the post recursion nor the rewrite recursion consults it.\n  \nMeasured on 5.0.6:\n\n| groups (n) | input bytes | time |\n|---|---|---|\n| 20 | 60 | 130 ms |\n| 24 | 72 | 1.9 s |\n| 26 | 78 | 7.8 s |\n| 30 (PoC) | 90 | ~2 min |\n\n### Proof of concept\n```js\nconst { expand } = require('brace-expansion');\n// 30 non-expanding groups, ~90 bytes — blocks for minutes:\nexpand('a{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{},{}');\n```\n\n### Impact\n\nAny application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch/glob brace patterns - can be driven into a multi-minute-to-indefinite CPU hang by a tiny request, denying service on that thread/process.\n\n### Remediation\n\nUpgrade to a patched release. The fix:\n1. Defers computing post until after the early-return branches (and computes it locally in the $-suffix branch), so post is only expanded when a brace set actually expands and the value is used. This alone removes the exponential.\n1. Converts the {a},b} rewrite from recursion to an in-function loop, so a long run of rewrites cannot grow the call stack.\n\nVerified: the PoC drops from ~2 min to 0.55 ms, 5,000 groups complete in ~344 ms, and output is identical to 5.0.6 across a behavioral-equivalence suite (sequences, padding, $-prefix, a{},b}c, {},a}b, x{{a,b}}y, etc.). Post-fix complexity is ~O(n²) on this input class - acceptable for the security fix; a linear rewrite can be a non-urgent follow-up.\n\nIf immediate upgrade isn't possible, avoid passing untrusted input to expand() / glob brace patterns, or run such expansion under a timeout/worker.","status":"published","published":"2026-07-20T20:51:09Z","modified":"2026-09-10T03:51:10.092354944Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RHSA-2026:33866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-01T10:19:52Z","modified":"2026-10-20T10:07:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:34478","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-02T10:17:47Z","modified":"2026-10-20T10:07:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:35272","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-04T10:08:01Z","modified":"2026-10-20T10:07:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:45360","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-28T10:13:34Z","modified":"2026-10-20T10:09:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47057","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-08-04T10:25:35Z","modified":"2026-10-20T10:09:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47058","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-08-03T10:17:09Z","modified":"2026-10-20T10:09:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47059","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-07-29T10:11:31Z","modified":"2026-10-20T10:09:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47060","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-07-29T10:11:31Z","modified":"2026-10-20T10:09:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48032","title":"Red Hat Security Advisory: nodejs-nodemon security update","status":"published","published":"2026-07-30T10:18:00Z","modified":"2026-10-20T10:09:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48033","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-07-30T10:18:00Z","modified":"2026-10-20T10:09:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48034","title":"Red Hat Security Advisory: nodejs24 security update","status":"published","published":"2026-07-30T10:18:01Z","modified":"2026-10-20T10:09:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:52394","title":"Red Hat Security Advisory: nodejs-nodemon security update","status":"published","published":"2026-08-10T10:13:32Z","modified":"2026-10-20T10:10:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52399","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-08-10T10:13:35Z","modified":"2026-10-20T10:10:41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52990","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-11T10:12:09Z","modified":"2026-10-20T10:10:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53298","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-08-11T10:12:11Z","modified":"2026-10-20T10:10:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","status":"published","published":"2026-08-21T10:14:02Z","modified":"2026-10-20T10:11:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:47057","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n\n* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-03T12:03:50.556944Z","modified":"2026-08-03T12:30:05.427152632Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:47058","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n\n* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-03T12:03:50.556944Z","modified":"2026-08-03T12:30:05.425318376Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:47059","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n\n* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-29T00:01:14.049135Z","modified":"2026-07-29T00:30:06.136844251Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:47060","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n\n* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-28T18:01:06.552042Z","modified":"2026-07-28T18:25:47.228678538Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:48032","title":"Important: nodejs-nodemon security update","description":"Simple monitor script for use during development of a node.js app.  For use during development of a node.js based application.  nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application.  nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word \"node\" on the command line when you run your script.\n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-30T12:06:30.380063Z","modified":"2026-07-30T12:30:06.853936132Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:48033","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n\n* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-31T18:06:02.939248Z","modified":"2026-07-31T18:25:52.039621453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:48034","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n\n* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-31T18:06:02.939248Z","modified":"2026-07-31T18:25:52.105773599Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-13149","description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","status":"published","published":"2026-06-30T10:16:00Z","modified":"2026-10-17T12:59:52.7021414Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:47057","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:32:23.631815018Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:47058","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:32:22.379432754Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:47059","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:02:24.725187741Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:47060","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:02:24.807811956Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:48032","title":"Important: nodejs-nodemon security update","description":"Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word \"node\" on the command line when you run your script.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-29T00:00:00Z","modified":"2026-10-29T11:30:33.03848567Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:48033","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-29T00:00:00Z","modified":"2026-10-29T11:30:32.486378309Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:48034","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)\n  * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)\n  * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-29T00:00:00Z","modified":"2026-10-29T11:30:32.785191006Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"CLSA-2026-1784596285","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:54.07268115Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1791626852","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.3.","status":"published","published":"2026-10-10T10:07:32Z","modified":"2026-10-25T13:43:07.933373499Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791798665","title":"TuxCare security update for brace-expansion (6 CVEs)","description":"TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.","status":"published","published":"2026-10-12T09:51:05Z","modified":"2026-10-15T09:47:40.086570225Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806331","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3.","status":"published","published":"2026-10-12T11:58:51Z","modified":"2026-10-15T09:47:40.04747697Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792232943","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.14-tuxcare.4.","status":"published","published":"2026-10-17T10:29:03Z","modified":"2026-10-17T13:09:26.489482822Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792233030","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.12-tuxcare.5.","status":"published","published":"2026-10-17T10:30:30Z","modified":"2026-10-25T13:43:06.302490637Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792233116","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.15-tuxcare.4.","status":"published","published":"2026-10-17T10:31:56Z","modified":"2026-10-17T13:09:25.885795588Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792233308","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 4.0.1-tuxcare.3.","status":"published","published":"2026-10-17T10:35:08Z","modified":"2026-10-17T13:09:28.322028041Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792243228","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 2.0.2-tuxcare.4.","status":"published","published":"2026-10-17T13:20:28Z","modified":"2026-10-17T19:01:10.667768977Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792448853","title":"TuxCare security update for brace-expansion (6 CVEs)","description":"TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.6-tuxcare.1.","status":"published","published":"2026-10-19T22:27:33Z","modified":"2026-10-20T01:45:18.158609713Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792453589","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.","status":"published","published":"2026-10-19T23:46:29Z","modified":"2026-10-20T01:45:14.461302451Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479350","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.","status":"published","published":"2026-10-20T06:55:50Z","modified":"2026-10-20T13:45:06.057962897Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793808172","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.3-tuxcare.3.","status":"published","published":"2026-11-04T17:02:53Z","modified":"2026-11-04T19:00:37.189721773Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"openSUSE-SU-2026:11220-1","title":"python313-pytest-html-4.2.0-4.1 on GA media","description":"These are all security issues fixed in the python313-pytest-html-4.2.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-09T10:00:13.445680646Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11452-1","title":"agama-integration-tests-1785848065.5562c7c-4.1 on GA media","description":"These are all security issues fixed in the agama-integration-tests-1785848065.5562c7c-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-05T00:00:00Z","modified":"2026-08-06T11:15:07.907339068Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.960220408Z","updated_at":"2026-11-02T16:58:39.516824Z"}]},"sources_more":{"osv":5}}