{"id":"CVE-2026-14257","aliases":["ALSA-2026:54371","ALSA-2026:54530","ALSA-2026:55541","ALSA-2026:55601","ALSA-2026:55603","ALSA-2026:58819","AZL-94520","AZL-94535","CLSA-2026-1774311647","CLSA-2026-1781830551","CLSA-2026-1784856030","CLSA-2026-1785291241","CLSA-2026-1790252886","CLSA-2026-1790253961","CLSA-2026-1791200030","CLSA-2026-1791798665","CLSA-2026-1791806331","CLSA-2026-1792232943","CLSA-2026-1792233116","CLSA-2026-1792233308","CLSA-2026-1792243228","CLSA-2026-1792448853","CLSA-2026-1792453589","CLSA-2026-1792479350","CLSA-2026-1793808172","DEBIAN-CVE-2026-14257","EUVD-2026-48285","GHSA-5c6j-r48x-rmvq","GHSA-mh99-v99m-4gvg","RHSA-2026:45360","RHSA-2026:45381","RHSA-2026:45784","RHSA-2026:50290","RHSA-2026:54183","RHSA-2026:54371","RHSA-2026:54389","RHSA-2026:54530","RHSA-2026:55541","RHSA-2026:55601","RHSA-2026:55603","RHSA-2026:57590","RHSA-2026:58819","RHSA-2026:62416","RHSA-2026:64817","RLSA-2026:54371","RLSA-2026:54530","RLSA-2026:55541","RLSA-2026:55601","RLSA-2026:55603","RLSA-2026:58819","ROOT-APP-NPM-CVE-2026-14257","UBUNTU-CVE-2026-14257","openSUSE-SU-2026:12070-1"],"status":"published","title":"brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00643,"percentile":0.51321,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-07-23T12:54:23Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"brace-expansion","fixed_in":["5.0.8","3.0.3","2.1.3","1.1.17"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"brace-expansion","fixed_in":["2.0.1-tuxcare.3","2.1.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"brace-expansion","fixed_in":["5.0.7-aikido.3","2.0.1-aikido.4","2.0.2-aikido.3","1.1.12-aikido.3","1.1.15-aikido.2","1.1.14-aikido.2","2.1.0-aikido.2","1.1.16-aikido.1","5.0.5-aikido.3","5.0.6-aikido.2","2.0.3-aikido.2","2.1.2-aikido.1","1.1.11-aikido.5","2.1.1-aikido.2","1.1.13-aikido.2","5.0.7-aikido.1","1.1.12-aikido.4","2.1.1-aikido.3","2.0.3-aikido.3","1.1.11-aikido.6","5.0.5-aikido.4","2.0.1-aikido.5","5.0.6-aikido.3","2.0.2-aikido.4","1.1.15-aikido.3","1.1.13-aikido.3","5.0.4-aikido.4","2.1.0-aikido.3","5.0.4-aikido.5","2.1.2-aikido.2","1.1.14-aikido.3","1.1.16-aikido.2","1.1.15-aikido.4","5.0.6-aikido.4","2.1.0-aikido.4","5.0.7-aikido.2","5.0.3-aikido.4","5.0.3-aikido.5","5.0.6-aikido.5","5.0.6-aikido.6","2.0.1-aikido.6","1.1.12-aikido.5","1.1.13-aikido.4","1.1.12-aikido.6","1.1.13-aikido.5","2.0.1-aikido.7","1.1.14-aikido.4","1.1.11-aikido.7","1.1.14-aikido.5","5.0.7-aikido.4","2.0.2-aikido.5","2.0.2-aikido.6","2.1.0-aikido.5","5.0.5-aikido.5","5.0.3-aikido.6","5.0.8-aikido.1","5.0.8-aikido.2","5.0.8-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/brace-expansion","fixed_in":["5.0.7-root.io.3","2.0.1-root.io.4","2.0.2-root.io.3","1.1.12-root.io.3","1.1.15-root.io.2","1.1.14-root.io.2","2.1.0-root.io.2","1.1.16-root.io.1","5.0.5-root.io.3","5.0.6-root.io.2","2.0.3-root.io.2","2.1.2-root.io.1","1.1.11-root.io.5","2.1.1-root.io.2","1.1.13-root.io.2","5.0.7-root.io.1","1.1.12-root.io.4","2.1.1-root.io.3","2.0.3-root.io.3","1.1.11-root.io.6","5.0.5-root.io.4","2.0.1-root.io.5","5.0.6-root.io.3","2.0.2-root.io.4","1.1.15-root.io.3","1.1.13-root.io.3","5.0.4-root.io.4","2.1.0-root.io.3","5.0.4-root.io.5","2.1.2-root.io.2","1.1.14-root.io.3","1.1.16-root.io.2","1.1.15-root.io.4","5.0.6-root.io.4","2.1.0-root.io.4","5.0.7-root.io.2","5.0.3-root.io.4","5.0.3-root.io.5","5.0.6-root.io.5","5.0.6-root.io.6","2.0.1-root.io.6","1.1.12-root.io.5","1.1.13-root.io.4","1.1.12-root.io.6","1.1.13-root.io.5","2.0.1-root.io.7","1.1.14-root.io.4","1.1.11-root.io.7","1.1.14-root.io.5","5.0.7-root.io.4","2.0.2-root.io.5","2.0.2-root.io.6","2.1.0-root.io.5","5.0.5-root.io.5","5.0.3-root.io.6","5.0.8-root.io.1","5.0.8-root.io.2","5.0.8-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.17"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el8.10.0+4250+09238ed4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el8.10.0+4250+09238ed4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el8.10.0+4250+09238ed4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el8.10.0+4250+09238ed4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module_el8.10.0+4250+09238ed4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el8.10.0+4251+b427b8a5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el8.10.0+4251+b427b8a5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el8.10.0+4251+b427b8a5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el8.10.0+4251+b427b8a5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el8.10.0+4251+b427b8a5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4252+aedd4c30"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.3.module_el8.10.0+4251+b427b8a5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el9.8.0+291+0bb98cce"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el9.8.0+291+0bb98cce"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el9.8.0+291+0bb98cce"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el9.8.0+291+0bb98cce"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module_el9.8.0+291+0bb98cce"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el9.8.0+291+0bb98cce"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.11-tuxcare.0"},{"fixed":"1.1.11-tuxcare.1"}]}],"versions":["1.1.11"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.1-tuxcare.0"},{"fixed":"2.0.1-tuxcare.3"}]}],"versions":["2.0.1","2.0.1-tuxcare.1","2.0.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2-tuxcare.0"},{"fixed":"2.1.2-tuxcare.1"}]}],"versions":["2.1.2"]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els19"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.16-tuxcare.0"},{"fixed":"1.1.16-tuxcare.4"}]}],"versions":["1.1.16","1.1.16-tuxcare.1","1.1.16-tuxcare.2","1.1.16-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5-tuxcare.0"},{"fixed":"5.0.5-tuxcare.2"}]}],"versions":["5.0.5","5.0.5-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.4-tuxcare.0"},{"fixed":"5.0.4-tuxcare.3"}]}],"versions":["5.0.4","5.0.4-tuxcare.1","5.0.4-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.14-tuxcare.0"},{"fixed":"1.1.14-tuxcare.4"}]}],"versions":["1.1.14","1.1.14-tuxcare.1","1.1.14-tuxcare.2","1.1.14-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.15-tuxcare.0"},{"fixed":"1.1.15-tuxcare.4"}]}],"versions":["1.1.15","1.1.15-tuxcare.1","1.1.15-tuxcare.2","1.1.15-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.3"}]}],"versions":["4.0.1","4.0.1-tuxcare.1","4.0.1-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.4"}]}],"versions":["2.0.2","2.0.2-tuxcare.1","2.0.2-tuxcare.2","2.0.2-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.6-tuxcare.0"},{"fixed":"5.0.6-tuxcare.1"}]}],"versions":["5.0.6"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3-tuxcare.0"},{"fixed":"5.0.3-tuxcare.1"}]}],"versions":["5.0.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2-tuxcare.0"},{"fixed":"5.0.2-tuxcare.1"}]}],"versions":["5.0.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.3-tuxcare.0"},{"fixed":"1.1.3-tuxcare.3"}]}],"versions":["1.1.3","1.1.3-tuxcare.1","1.1.3-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2","2.0.1-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"5.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.17"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.17.0-1.26.5.0.1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.0-1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.5.0.1.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.8-1.22.23.1.2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.254.21-1.22.23.1.2.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.0.0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.6-0.4.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.1.0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.6.233.17-1.24.18.1.0.2.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24562+090c6525"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24562+090c6525"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.19.0-1.26.7.0.1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.7.0-1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.7.0.1.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24500+8eb51621"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24500+8eb51621"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24156+bb41d456"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24156+bb41d456"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24355+35d95b59"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+24355+35d95b59"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rh-podman-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.2-1.el10_2"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.16.0-1.24.18.0.5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.6.0+24789+4011c12f"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.8-1.22.23.2.1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.2-1.el10_0"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-3.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el8.10.0+40278+50b003a3"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-3.module+el9.8.0+40280+057606e8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40264+d9b257bb"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.8.0+40280+057606e8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-6.module+el9.8.0+40281+14cc6568"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.18.0-5.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7-aikido.3"},{"fixed":"2.0.1-aikido.4"},{"fixed":"2.0.2-aikido.3"},{"fixed":"1.1.12-aikido.3"},{"fixed":"1.1.15-aikido.2"},{"fixed":"1.1.14-aikido.2"},{"fixed":"2.1.0-aikido.2"},{"fixed":"1.1.16-aikido.1"},{"fixed":"5.0.5-aikido.3"},{"fixed":"5.0.6-aikido.2"},{"fixed":"2.0.3-aikido.2"},{"fixed":"2.1.2-aikido.1"},{"fixed":"1.1.11-aikido.5"},{"fixed":"2.1.1-aikido.2"},{"fixed":"1.1.13-aikido.2"},{"fixed":"5.0.7-aikido.1"},{"fixed":"1.1.12-aikido.4"},{"fixed":"2.1.1-aikido.3"},{"fixed":"2.0.3-aikido.3"},{"fixed":"1.1.11-aikido.6"},{"fixed":"5.0.5-aikido.4"},{"fixed":"2.0.1-aikido.5"},{"fixed":"5.0.6-aikido.3"},{"fixed":"2.0.2-aikido.4"},{"fixed":"1.1.15-aikido.3"},{"fixed":"1.1.13-aikido.3"},{"fixed":"5.0.4-aikido.4"},{"fixed":"2.1.0-aikido.3"},{"fixed":"5.0.4-aikido.5"},{"fixed":"2.1.2-aikido.2"},{"fixed":"1.1.14-aikido.3"},{"fixed":"1.1.16-aikido.2"},{"fixed":"1.1.15-aikido.4"},{"fixed":"5.0.6-aikido.4"},{"fixed":"2.1.0-aikido.4"},{"fixed":"5.0.7-aikido.2"},{"fixed":"5.0.3-aikido.4"},{"fixed":"5.0.3-aikido.5"},{"fixed":"5.0.6-aikido.5"},{"fixed":"5.0.6-aikido.6"},{"fixed":"2.0.1-aikido.6"},{"fixed":"1.1.12-aikido.5"},{"fixed":"1.1.13-aikido.4"},{"fixed":"1.1.12-aikido.6"},{"fixed":"1.1.13-aikido.5"},{"fixed":"2.0.1-aikido.7"},{"fixed":"1.1.14-aikido.4"},{"fixed":"1.1.11-aikido.7"},{"fixed":"1.1.14-aikido.5"},{"fixed":"5.0.7-aikido.4"},{"fixed":"2.0.2-aikido.5"},{"fixed":"2.0.2-aikido.6"},{"fixed":"2.1.0-aikido.5"},{"fixed":"5.0.5-aikido.5"},{"fixed":"5.0.3-aikido.6"},{"fixed":"5.0.8-aikido.1"},{"fixed":"5.0.8-aikido.2"},{"fixed":"5.0.8-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7-root.io.3"},{"fixed":"2.0.1-root.io.4"},{"fixed":"2.0.2-root.io.3"},{"fixed":"1.1.12-root.io.3"},{"fixed":"1.1.15-root.io.2"},{"fixed":"1.1.14-root.io.2"},{"fixed":"2.1.0-root.io.2"},{"fixed":"1.1.16-root.io.1"},{"fixed":"5.0.5-root.io.3"},{"fixed":"5.0.6-root.io.2"},{"fixed":"2.0.3-root.io.2"},{"fixed":"2.1.2-root.io.1"},{"fixed":"1.1.11-root.io.5"},{"fixed":"2.1.1-root.io.2"},{"fixed":"1.1.13-root.io.2"},{"fixed":"5.0.7-root.io.1"},{"fixed":"1.1.12-root.io.4"},{"fixed":"2.1.1-root.io.3"},{"fixed":"2.0.3-root.io.3"},{"fixed":"1.1.11-root.io.6"},{"fixed":"5.0.5-root.io.4"},{"fixed":"2.0.1-root.io.5"},{"fixed":"5.0.6-root.io.3"},{"fixed":"2.0.2-root.io.4"},{"fixed":"1.1.15-root.io.3"},{"fixed":"1.1.13-root.io.3"},{"fixed":"5.0.4-root.io.4"},{"fixed":"2.1.0-root.io.3"},{"fixed":"5.0.4-root.io.5"},{"fixed":"2.1.2-root.io.2"},{"fixed":"1.1.14-root.io.3"},{"fixed":"1.1.16-root.io.2"},{"fixed":"1.1.15-root.io.4"},{"fixed":"5.0.6-root.io.4"},{"fixed":"2.1.0-root.io.4"},{"fixed":"5.0.7-root.io.2"},{"fixed":"5.0.3-root.io.4"},{"fixed":"5.0.3-root.io.5"},{"fixed":"5.0.6-root.io.5"},{"fixed":"5.0.6-root.io.6"},{"fixed":"2.0.1-root.io.6"},{"fixed":"1.1.12-root.io.5"},{"fixed":"1.1.13-root.io.4"},{"fixed":"1.1.12-root.io.6"},{"fixed":"1.1.13-root.io.5"},{"fixed":"2.0.1-root.io.7"},{"fixed":"1.1.14-root.io.4"},{"fixed":"1.1.11-root.io.7"},{"fixed":"1.1.14-root.io.5"},{"fixed":"5.0.7-root.io.4"},{"fixed":"2.0.2-root.io.5"},{"fixed":"2.0.2-root.io.6"},{"fixed":"2.1.0-root.io.5"},{"fixed":"5.0.5-root.io.5"},{"fixed":"5.0.3-root.io.6"},{"fixed":"5.0.8-root.io.1"},{"fixed":"5.0.8-root.io.2"},{"fixed":"5.0.8-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1","1.1.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2","2.0.1+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.7.0.git145.b60ef1146-1.1"}]}],"bundled":40}],"products":[{"vendor":"juliangruber","product":"brace-expansion"}],"references":[{"url":"https://www.npmjs.com/package/brace-expansion","tags":["Product","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["Product","package","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","tags":["Patch","fix","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","tags":["web","advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/pull/129","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/pull/130","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/pull/136","tags":["web"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["web","article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["web","article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mh99-v99m-4gvg"},{"url":"https://access.redhat.com/errata/RHSA-2026:54371","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11822","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11824","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14257","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54272","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69192","tags":["report"]},{"url":"https://bugzilla.redhat.com/2506433","tags":["report"]},{"url":"https://bugzilla.redhat.com/2507593","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510722","tags":["report"]},{"url":"https://bugzilla.redhat.com/2510801","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-54371.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54530","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-54530.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55541","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55541.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55601","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55601.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-54272.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55603","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-55603.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58819","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-58819.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790252886.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790253961.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14257.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-14257","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:45360","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45360.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14257","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:45381","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48617","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45381.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48617","tags":["advisory"]},{"url":"http://hackerone.com/reports/3692858","tags":["article"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:45784","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43823","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45784.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43823","tags":["advisory"]},{"url":"https://github.com/apple/swift-crypto/security/advisories/GHSA-8q93-f6xh-4f6f","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50290","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50290.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54183","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54183.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510801","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54371.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11822","tags":["advisory"]},{"url":"https://sqlite.org/releaselog/3_53_2.html","tags":["article"]},{"url":"https://sqlite.org/src/info/061febcf41ca","tags":["article"]},{"url":"https://sqlite.org/src/info/4a5ad516ea93","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11824","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54272","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54389","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84947","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85152","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84890","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85014","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85008","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48932","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54389.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18149","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48932","tags":["advisory"]},{"url":"https://hackerone.com/reports/3564941","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84890","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84933","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84947","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85008","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85008","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85014","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85152","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54530.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55541.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55601.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55603.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-238929","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595","tags":["advisory"]},{"url":"https://github.com/facebook/create-react-app/pull/7444","tags":["article"]},{"url":"https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/pull/4316","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","tags":["advisory"]},{"url":"https://cwe.mitre.org/data/definitions/93.html","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","tags":["article"]},{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","tags":["article"]},{"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","tags":["article"]},{"url":"https://www.npmjs.com/package/form-data","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","tags":["article"]},{"url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42338","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42570","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.8.1","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","tags":["advisory"]},{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45740","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48068","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","tags":["advisory"]},{"url":"https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","tags":["article"]},{"url":"https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.7","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56876","tags":["advisory"]},{"url":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","tags":["article"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59873","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.19","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59874","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59877","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/pull/2352","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58819.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62416","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511089","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62416.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56846","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56846","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56847","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56848","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56848","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56848","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509179","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56850","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56850","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58039","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58040","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510854","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58042","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58043","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58043","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58044","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58045","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:64817","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64817.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:54371","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:54530","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55541","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55601","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55603","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:58819","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14257","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-14257","title":"brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","status":"published","published":"2026-07-23T12:54:23.124Z","modified":"2026-07-23T14:44:41.856Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-48285","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","status":"published","published":"2026-07-23T12:54:23Z","modified":"2026-07-23T14:44:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:43.496187Z"}],"ghsa":[{"id":"GHSA-mh99-v99m-4gvg","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","description":"### Summary\n\n`expand()` bounds the *number* of results it produces (the `max` option,\n`100_000` by default) but not their *length*. By chaining many brace groups,\nan attacker keeps the result count under `max` while making every result grow\nwith the number of groups. Building `max` long results — plus the intermediate\narrays combined at each brace group — exhausts memory and crashes the Node\nprocess with an **uncatchable** out-of-memory error. `try/catch` around\n`expand()` does not help: the fatal error terminates the process.\n\nA ~7.5 KB input (`'{a,b}'.repeat(1500)`) is enough to crash a default Node\nprocess.\n\n### Details\n\nFor `N` chained brace groups such as `'{a,b}'.repeat(N)`:\n\n- the result count is `2^N`, immediately capped at `max` (`100_000`), so the\n  `max` protection appears to hold, but\n- each result is `N` characters long, so the total output size is\n  `max × N` characters, which grows without bound in `N`.\n\n`expand_` combines each brace set with the fully-expanded tail:\n\n```js\nconst post = m.post.length ? expand_(m.post, max, false) : ['']\n...\nfor (let j = 0; j \u003c N.length; j++) {\n  for (let k = 0; k \u003c post.length \u0026\u0026 expansions.length \u003c max; k++) {\n    const expansion = pre + N[j] + post[k]   // grows one group longer per level\n    ...\n    expansions.push(expansion)\n  }\n}\n```\n\nThe loop guard `expansions.length \u003c max` limits how many strings are built, but\nnothing limits how long they get. Each recursion level materializes another\narray of up to `max` strings, one character longer than the level below, and —\nbecause V8 represents `pre + N[j] + post[k]` as a cons-string (rope) that\nreferences `post[k]` — those intermediate strings stay reachable through the\nwhole chain. Memory therefore scales with `max × N`.\n\nMeasured on `5.0.7` (`'{a,b}'.repeat(N)`, default `max`):\n\n| groups (N) | input bytes | result count | peak RSS |\n|---|---|---|---|\n| 20 | 100 | 100,000 | ~80 MB |\n| 50 | 250 | 100,000 | ~214 MB |\n| 100 | 500 | 100,000 | ~409 MB |\n| 300 | 1,500 | 100,000 | ~1,148 MB |\n| 1500 | 7,500 | — | **OOM crash** |\n\n### Proof of concept\n\n```js\nconst { expand } = require('brace-expansion')\n\n// ~7.5 KB input — crashes the process with a fatal, uncatchable OOM:\n//   FATAL ERROR: ... JavaScript heap out of memory\ntry {\n  expand('{a,b}'.repeat(1500))\n} catch (e) {\n  // never reached — the process is already dead\n}\n```\n\n### Impact\n\nAny application that passes attacker-influenced strings to\n`brace-expansion.expand()` — directly, or transitively via `minimatch` / `glob`\nbrace patterns — can be crashed by a small request. Because the failure is a\nfatal V8 out-of-memory error rather than a thrown exception, it cannot be caught\nand it takes down the whole worker/process, denying service.\n\n### Remediation\n\nUpgrade to a patched release. The fix bounds the total number of characters a\nsingle `expand()` call may accumulate (`EXPANSION_MAX_LENGTH`, default\n`4_000_000`, configurable via a new `maxLength` option), applied inside the\noutput-building loops so intermediate arrays are bounded too. Once the limit is\nreached, output is truncated — consistent with how `max` already truncates —\ninstead of growing without bound. The limit sits well above any realistic\nexpansion (100,000 results hitting `max` measure ~1M characters), so legitimate\ninput is unaffected.\n\nAfter the fix, `'{a,b}'.repeat(1500)` returns a bounded, truncated result in\n~0.7 s using ~340 MB and never crashes, including under a constrained 512 MB\nheap.\n\nThe fix bounds memory but the algorithm still rebuilds intermediate arrays at\neach level (roughly `O(N × maxLength)` work on this input class). A streaming\nrewrite that produces output in `O(total output size)` can be a non-urgent\nfollow-up.\n\nIf immediate upgrade isn't possible, avoid passing untrusted input to\n`expand()` / glob brace patterns, or pass a small explicit `max` **and**\n`maxLength`.","status":"published","published":"2026-07-24T21:53:14Z","modified":"2026-07-31T19:37:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-14257","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","status":"published","published":"2026-07-23T14:17:00.25Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-14257","title":"brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","status":"published","published":"2026-07-23T12:54:23.124Z","modified":"2026-10-28T02:30:35.082483403Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-14257","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","status":"published","published":"2026-07-23T14:17:00.25Z","modified":"2026-10-25T10:00:59.169755753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:51.8748Z"},{"id":"GHSA-mh99-v99m-4gvg","title":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","description":"### Summary\n\n`expand()` bounds the *number* of results it produces (the `max` option,\n`100_000` by default) but not their *length*. By chaining many brace groups,\nan attacker keeps the result count under `max` while making every result grow\nwith the number of groups. Building `max` long results — plus the intermediate\narrays combined at each brace group — exhausts memory and crashes the Node\nprocess with an **uncatchable** out-of-memory error. `try/catch` around\n`expand()` does not help: the fatal error terminates the process.\n\nA ~7.5 KB input (`'{a,b}'.repeat(1500)`) is enough to crash a default Node\nprocess.\n\n### Details\n\nFor `N` chained brace groups such as `'{a,b}'.repeat(N)`:\n\n- the result count is `2^N`, immediately capped at `max` (`100_000`), so the\n  `max` protection appears to hold, but\n- each result is `N` characters long, so the total output size is\n  `max × N` characters, which grows without bound in `N`.\n\n`expand_` combines each brace set with the fully-expanded tail:\n\n```js\nconst post = m.post.length ? expand_(m.post, max, false) : ['']\n...\nfor (let j = 0; j \u003c N.length; j++) {\n  for (let k = 0; k \u003c post.length \u0026\u0026 expansions.length \u003c max; k++) {\n    const expansion = pre + N[j] + post[k]   // grows one group longer per level\n    ...\n    expansions.push(expansion)\n  }\n}\n```\n\nThe loop guard `expansions.length \u003c max` limits how many strings are built, but\nnothing limits how long they get. Each recursion level materializes another\narray of up to `max` strings, one character longer than the level below, and —\nbecause V8 represents `pre + N[j] + post[k]` as a cons-string (rope) that\nreferences `post[k]` — those intermediate strings stay reachable through the\nwhole chain. Memory therefore scales with `max × N`.\n\nMeasured on `5.0.7` (`'{a,b}'.repeat(N)`, default `max`):\n\n| groups (N) | input bytes | result count | peak RSS |\n|---|---|---|---|\n| 20 | 100 | 100,000 | ~80 MB |\n| 50 | 250 | 100,000 | ~214 MB |\n| 100 | 500 | 100,000 | ~409 MB |\n| 300 | 1,500 | 100,000 | ~1,148 MB |\n| 1500 | 7,500 | — | **OOM crash** |\n\n### Proof of concept\n\n```js\nconst { expand } = require('brace-expansion')\n\n// ~7.5 KB input — crashes the process with a fatal, uncatchable OOM:\n//   FATAL ERROR: ... JavaScript heap out of memory\ntry {\n  expand('{a,b}'.repeat(1500))\n} catch (e) {\n  // never reached — the process is already dead\n}\n```\n\n### Impact\n\nAny application that passes attacker-influenced strings to\n`brace-expansion.expand()` — directly, or transitively via `minimatch` / `glob`\nbrace patterns — can be crashed by a small request. Because the failure is a\nfatal V8 out-of-memory error rather than a thrown exception, it cannot be caught\nand it takes down the whole worker/process, denying service.\n\n### Remediation\n\nUpgrade to a patched release. The fix bounds the total number of characters a\nsingle `expand()` call may accumulate (`EXPANSION_MAX_LENGTH`, default\n`4_000_000`, configurable via a new `maxLength` option), applied inside the\noutput-building loops so intermediate arrays are bounded too. Once the limit is\nreached, output is truncated — consistent with how `max` already truncates —\ninstead of growing without bound. The limit sits well above any realistic\nexpansion (100,000 results hitting `max` measure ~1M characters), so legitimate\ninput is unaffected.\n\nAfter the fix, `'{a,b}'.repeat(1500)` returns a bounded, truncated result in\n~0.7 s using ~340 MB and never crashes, including under a constrained 512 MB\nheap.\n\nThe fix bounds memory but the algorithm still rebuilds intermediate arrays at\neach level (roughly `O(N × maxLength)` work on this input class). A streaming\nrewrite that produces output in `O(total output size)` can be a non-urgent\nfollow-up.\n\nIf immediate upgrade isn't possible, avoid passing untrusted input to\n`expand()` / glob brace patterns, or pass a small explicit `max` **and**\n`maxLength`.","status":"published","published":"2026-07-24T21:53:14Z","modified":"2026-09-10T03:50:12.282849322Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"RHSA-2026:45360","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-28T10:13:34Z","modified":"2026-10-20T10:09:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:45381","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-05T10:36:12Z","modified":"2026-10-20T10:09:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:45784","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-28T10:13:35Z","modified":"2026-10-20T10:09:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50290","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-05T10:37:36Z","modified":"2026-10-20T10:10:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:54183","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-12T10:16:47Z","modified":"2026-10-20T10:10:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54371","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-08-26T10:16:55Z","modified":"2026-10-20T10:11:04Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54389","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-13T10:17:44Z","modified":"2026-10-20T10:43:37.18683072Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54530","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-08-26T10:17:03Z","modified":"2026-10-20T10:11:11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55541","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-08-18T10:21:03Z","modified":"2026-10-20T10:11:19Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55601","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-08-26T10:17:16Z","modified":"2026-10-20T10:11:20Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55603","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-08-26T10:17:17Z","modified":"2026-10-20T10:11:21Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","status":"published","published":"2026-08-21T10:14:02Z","modified":"2026-10-20T10:11:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58819","title":"Red Hat Security Advisory: nodejs24 security update","status":"published","published":"2026-08-24T10:18:50Z","modified":"2026-10-20T10:11:49Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:62416","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-09-03T10:14:22Z","modified":"2026-10-20T10:12:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:64817","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-09-08T10:19:17Z","modified":"2026-10-20T10:13:05Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:54371","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n\n* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n\n* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n\n* ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n\n* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-25T18:03:44.543522Z","modified":"2026-08-26T00:18:19.536213432Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:54530","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n\n* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n\n* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n\n* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-25T18:03:44.543522Z","modified":"2026-08-26T00:18:19.556173148Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55541","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n\n* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T12:07:31.722662Z","modified":"2026-08-18T12:30:03.26455154Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55601","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n\n* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n\n* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n\n* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-25T18:04:05.699051Z","modified":"2026-08-26T00:27:31.293028649Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55603","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n\n* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n\n* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n\n* ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n\n* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-25T18:04:05.699051Z","modified":"2026-08-26T00:27:31.352794694Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:58819","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n\n* ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n\n* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-25T12:07:46.973584Z","modified":"2026-08-26T01:10:34.787638204Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-14257","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","status":"published","published":"2026-07-23T14:17:00Z","modified":"2026-10-17T12:58:05.229766197Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:54371","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n  * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n  * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-12T00:00:00Z","modified":"2026-10-29T11:02:28.869996732Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:54530","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n  * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-13T00:00:00Z","modified":"2026-10-29T11:02:28.852644168Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55541","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.461898052Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55601","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n  * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:42:20.928090001Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55603","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n  * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n  * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:11.177175418Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:58819","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)\n  * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)\n  * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-24T00:00:00Z","modified":"2026-10-29T11:30:47.292146203Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-94520","title":"CVE-2026-14257 affecting package js-jquery 3.5.0-4","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","status":"published","published":"2026-07-23T14:17:00Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-94535","title":"CVE-2026-14257 affecting package nodejs-nodemon 2.0.3-5","description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","status":"published","published":"2026-07-23T14:17:00Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1774311647","title":"TuxCare security update for formidable (4 CVEs)","description":"TuxCare rebuilt formidable to address 4 CVEs. Fixed in 2.1.2-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:14Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1781830551","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:47:09.338984981Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1784856030","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.1-tuxcare.3.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.694961997Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291241","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.876941317Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790252886","title":"nodejs: Fix of 5 CVEs","description":"- CVE-2026-14257: bound the total number of characters brace expansion may\n  accumulate in the bundled npm brace-expansion copies, so chained brace\n  groups can no longer grow every result until the process dies with an\n  uncatchable out-of-memory error\n- CVE-2026-59874: refuse a negative entry size in the bundled npm node-tar\n  copy, both when decoding a base-256 header field and when parsing a pax\n  size record, so a crafted archive can no longer stall tar.replace on a\n  scan that never advances past the same header\n- CVE-2026-69152: charge the intermediate arrays built for comma\n  alternatives and padded sequences against that same length budget,\n  closing a bypass that exhausted memory before the CVE-2026-14257 bound\n  could take effect","status":"published","published":"2026-09-24T12:28:19Z","modified":"2026-10-26T09:30:49.821749203Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790253961","title":"nodejs: Fix of 5 CVEs","description":"- CVE-2026-14257: bound the total number of characters brace expansion may\n  accumulate in the bundled npm brace-expansion copies, so chained brace\n  groups can no longer grow every result until the process dies with an\n  uncatchable out-of-memory error\n- CVE-2026-59874: refuse a negative entry size in the bundled npm node-tar\n  copy, both when decoding a base-256 header field and when parsing a pax\n  size record, so a crafted archive can no longer stall tar.replace on a\n  scan that never advances past the same header\n- CVE-2026-69152: charge the intermediate arrays built for comma\n  alternatives and padded sequences against that same length budget,\n  closing a bypass that exhausted memory before the CVE-2026-14257 bound\n  could take effect","status":"published","published":"2026-09-24T16:33:04Z","modified":"2026-10-26T09:31:35.72528827Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791200030","title":"TuxCare security update for brace-expansion (2 CVEs)","description":"TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 1.1.16-tuxcare.4.","status":"published","published":"2026-10-05T11:33:50Z","modified":"2026-10-15T09:47:58.154069758Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791798665","title":"TuxCare security update for brace-expansion (6 CVEs)","description":"TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.","status":"published","published":"2026-10-12T09:51:05Z","modified":"2026-10-15T09:47:40.086570225Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806331","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3.","status":"published","published":"2026-10-12T11:58:51Z","modified":"2026-10-15T09:47:40.04747697Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792232943","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.14-tuxcare.4.","status":"published","published":"2026-10-17T10:29:03Z","modified":"2026-10-17T13:09:26.489482822Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792233116","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.15-tuxcare.4.","status":"published","published":"2026-10-17T10:31:56Z","modified":"2026-10-17T13:09:25.885795588Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792233308","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 4.0.1-tuxcare.3.","status":"published","published":"2026-10-17T10:35:08Z","modified":"2026-10-17T13:09:28.322028041Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792243228","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 2.0.2-tuxcare.4.","status":"published","published":"2026-10-17T13:20:28Z","modified":"2026-10-17T19:01:10.667768977Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792448853","title":"TuxCare security update for brace-expansion (6 CVEs)","description":"TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.6-tuxcare.1.","status":"published","published":"2026-10-19T22:27:33Z","modified":"2026-10-20T01:45:18.158609713Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792453589","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.","status":"published","published":"2026-10-19T23:46:29Z","modified":"2026-10-20T01:45:14.461302451Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479350","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.","status":"published","published":"2026-10-20T06:55:50Z","modified":"2026-10-20T13:45:06.057962897Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793808172","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.3-tuxcare.3.","status":"published","published":"2026-11-04T17:02:53Z","modified":"2026-11-04T19:00:37.189721773Z","updated_at":"2026-11-04T19:15:03.6858Z"}]},"sources_more":{"osv":2}}