{"id":"CVE-2026-45149","aliases":["CLSA-2026-1791215768","CLSA-2026-1791226577","CLSA-2026-1792453589","CLSA-2026-1792479350","DEBIAN-CVE-2026-45149","EUVD-2026-33442","GHSA-jxxr-4gwj-5jf2","RHSA-2026:13874","RHSA-2026:17682","RHSA-2026:22380","RHSA-2026:22934","RHSA-2026:24069","RHSA-2026:7378","RHSA-2026:7387","RHSA-2026:7634","RHSA-2026:7655","RHSA-2026:9455","ROOT-APP-NPM-CVE-2026-45149","UBUNTU-CVE-2026-45149"],"status":"published","title":"brace-expansion: Large numeric range defeats documented `max` DoS protection","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.003,"percentile":0.229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-04-21T10:09:52Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"npm","package":"brace-expansion","fixed_in":["5.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"brace-expansion","fixed_in":["5.0.5-tuxcare.1","5.0.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-brace-expansion","fixed_in":["2.0.3+~1.1.2-3"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","fixed_in":["0:24.15.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","fixed_in":["0:24.15.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","fixed_in":["0:24.15.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","fixed_in":["0:24.15.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","fixed_in":["0:24.15.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","fixed_in":["0:24.15.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","fixed_in":["0:11.12.1-1.24.15.0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","fixed_in":["0:24.15.0-1.hum1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"brace-expansion","fixed_in":["5.0.5-aikido.1","5.0.3-aikido.2","5.0.5-aikido.2","5.0.5-aikido.3","5.0.5-aikido.4","5.0.4-aikido.2","5.0.4-aikido.3","5.0.4-aikido.4","5.0.4-aikido.5","5.0.3-aikido.3","5.0.3-aikido.4","5.0.3-aikido.5","5.0.5-aikido.5","5.0.3-aikido.6","5.0.6-aikido.1","5.0.6-aikido.2","5.0.6-aikido.3","5.0.6-aikido.4","5.0.6-aikido.5","5.0.6-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/brace-expansion","fixed_in":["5.0.5-root.io.1","5.0.3-root.io.2","5.0.5-root.io.2","5.0.5-root.io.3","5.0.5-root.io.4","5.0.4-root.io.2","5.0.4-root.io.3","5.0.4-root.io.4","5.0.4-root.io.5","5.0.3-root.io.3","5.0.3-root.io.4","5.0.3-root.io.5","5.0.5-root.io.5","5.0.3-root.io.6","5.0.6-root.io.1","5.0.6-root.io.2","5.0.6-root.io.3","5.0.6-root.io.4","5.0.6-root.io.5","5.0.6-root.io.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5-tuxcare.0"},{"fixed":"5.0.5-tuxcare.1"}]}],"versions":["5.0.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.4-tuxcare.0"},{"fixed":"5.0.4-tuxcare.1"}]}],"versions":["5.0.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3-tuxcare.0"},{"fixed":"5.0.3-tuxcare.1"}]}],"versions":["5.0.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2-tuxcare.0"},{"fixed":"5.0.2-tuxcare.1"}]}],"versions":["5.0.2"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2","2.0.1-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+~1.1.2-3"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2"]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.6"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.15.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.15.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.15.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.15.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.15.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.15.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.12.1-1.24.15.0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.15.0-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.127-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.3.0-1.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.3.0-1.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.3.0-1.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.3.0-1.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.3.0-1.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.3.0-1.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.26.3.0.1.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.3.0-1.2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-none-softfloat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-i686-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-none","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.0-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang21-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang21-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang21-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang21-resource-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang21-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang21-tools-extra-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"compiler-rt21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"git-clang-format21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libomp21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libomp21-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lld21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lld21-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lld21-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lldb21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lldb21-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21-cmake-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21-googletest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm21-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-clang21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-6.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.12.1-1.25.9.0.1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.4-1.22.22.0.1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.22.0-1.3.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang-resource-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang-tools-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clang-tools-extra-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"compiler-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"git-clang-format","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcxx-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcxx-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcxxabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcxxabi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcxxabi-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libomp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lld","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lld-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lld-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lldb-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-bolt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-cmake-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-googletest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-libunwind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-libunwind-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-libunwind-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"llvm-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mlir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mlir-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mlir-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"polly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"polly-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-clang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-lit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-mlir","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.1.8-1.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.22-18.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.8.2-1.20.20.2.1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Root:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-aikido.1"},{"fixed":"5.0.3-aikido.2"},{"fixed":"5.0.5-aikido.2"},{"fixed":"5.0.5-aikido.3"},{"fixed":"5.0.5-aikido.4"},{"fixed":"5.0.4-aikido.2"},{"fixed":"5.0.4-aikido.3"},{"fixed":"5.0.4-aikido.4"},{"fixed":"5.0.4-aikido.5"},{"fixed":"5.0.3-aikido.3"},{"fixed":"5.0.3-aikido.4"},{"fixed":"5.0.3-aikido.5"},{"fixed":"5.0.5-aikido.5"},{"fixed":"5.0.3-aikido.6"},{"fixed":"5.0.6-aikido.1"},{"fixed":"5.0.6-aikido.2"},{"fixed":"5.0.6-aikido.3"},{"fixed":"5.0.6-aikido.4"},{"fixed":"5.0.6-aikido.5"},{"fixed":"5.0.6-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-root.io.1"},{"fixed":"5.0.3-root.io.2"},{"fixed":"5.0.5-root.io.2"},{"fixed":"5.0.5-root.io.3"},{"fixed":"5.0.5-root.io.4"},{"fixed":"5.0.4-root.io.2"},{"fixed":"5.0.4-root.io.3"},{"fixed":"5.0.4-root.io.4"},{"fixed":"5.0.4-root.io.5"},{"fixed":"5.0.3-root.io.3"},{"fixed":"5.0.3-root.io.4"},{"fixed":"5.0.3-root.io.5"},{"fixed":"5.0.5-root.io.5"},{"fixed":"5.0.3-root.io.6"},{"fixed":"5.0.6-root.io.1"},{"fixed":"5.0.6-root.io.2"},{"fixed":"5.0.6-root.io.3"},{"fixed":"5.0.6-root.io.4"},{"fixed":"5.0.6-root.io.5"},{"fixed":"5.0.6-root.io.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1","1.1.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2","2.0.1+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2"]}],"products":[{"vendor":"juliangruber","product":"brace-expansion"}],"references":[{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45149","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jxxr-4gwj-5jf2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45149.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13874","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45149","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13874.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45149","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17682","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42899","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8723","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17682.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476605","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42899","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22380","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6734","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9675","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9678","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22380.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490024","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6734","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9675","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490000","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9678","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9697","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22934","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9358","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44432","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51221","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22934.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9358","tags":["advisory"]},{"url":"https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9","tags":["article"]},{"url":"https://vuldb.com/submit/813080","tags":["article"]},{"url":"https://vuldb.com/vuln/365321","tags":["article"]},{"url":"https://vuldb.com/vuln/365321/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44432","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24069","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13573","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13574","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24069.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494424","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13573","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13573","tags":["advisory"]},{"url":"https://github.com/llvm/llvm-project/","tags":["article"]},{"url":"https://github.com/llvm/llvm-project/issues/199187","tags":["article"]},{"url":"https://github.com/user-attachments/files/28141697/poc.zip","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-13573","tags":["article"]},{"url":"https://vuldb.com/submit/844457","tags":["article"]},{"url":"https://vuldb.com/vuln/374581","tags":["article"]},{"url":"https://vuldb.com/vuln/374581/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13574","tags":["advisory"]},{"url":"https://github.com/llvm/llvm-project/issues/199191","tags":["article"]},{"url":"https://github.com/user-attachments/files/28142619/poc.zip","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-13574","tags":["article"]},{"url":"https://vuldb.com/submit/844468","tags":["article"]},{"url":"https://vuldb.com/vuln/374582","tags":["article"]},{"url":"https://vuldb.com/vuln/374582/cti","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7378","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59464","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55132","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55131","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55130","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2950","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48618","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48615","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48936","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48934","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48928","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48930","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48619","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48935","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7378.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55130","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431350","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55131","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55132","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59464","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48615","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48618","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48619","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48928","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48930","tags":["advisory"]},{"url":"https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e","tags":["article"]},{"url":"https://hackerone.com/reports/3656716","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493331","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48933","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48934","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48935","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48936","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7387","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21637","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21636","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59466","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59465","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21716","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7387.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431349","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59465","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59466","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21636","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21637","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453157","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21716","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21717","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7634","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7634.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7655","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7655.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9455","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9455.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-45149","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-45149","title":"brace-expansion: Large numeric range defeats documented `max` DoS protection","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.","status":"published","published":"2026-05-29T19:55:07.337Z","modified":"2026-06-01T16:44:23.371Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-33442","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.","status":"published","published":"2026-05-29T19:55:07Z","modified":"2026-06-01T16:44:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:58.316953Z"}],"ghsa":[{"id":"GHSA-jxxr-4gwj-5jf2","title":"brace-expansion: Large numeric range defeats documented `max` DoS protection","description":"The `max` option was being applied too late:\n\nWhen expanding a single large numeric range like `{1..10000000}`, the sequence generation loop generates all 10 million intermediate elements before the `max` limit is applied With `max=10`, the output is correctly limited to 10 items, but the process still allocates `~505 MB` and spends `~800ms` building the full intermediate array.\n\n### Workaround\n\nEnsure the string to be expanded doesn't contain more values than the desired `max` item count.","status":"published","published":"2026-05-18T16:22:01Z","modified":"2026-06-09T10:32:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2026-45149","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.","status":"published","published":"2026-05-29T20:16:25.55Z","modified":"2026-07-22T06:10:00.17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:21.635958Z"}],"osv":[{"id":"CVE-2026-45149","title":"brace-expansion: Large numeric range defeats documented `max` DoS protection","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.","status":"published","published":"2026-05-29T19:55:07.337Z","modified":"2026-10-28T02:30:52.958288258Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-45149","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.","status":"published","published":"2026-05-29T20:16:25.55Z","modified":"2026-10-01T03:03:05.873027703Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-jxxr-4gwj-5jf2","title":"brace-expansion: Large numeric range defeats documented `max` DoS protection","description":"The `max` option was being applied too late:\n\nWhen expanding a single large numeric range like `{1..10000000}`, the sequence generation loop generates all 10 million intermediate elements before the `max` limit is applied With `max=10`, the output is correctly limited to 10 items, but the process still allocates `~505 MB` and spends `~800ms` building the full intermediate array.\n\n### Workaround\n\nEnsure the string to be expanded doesn't contain more values than the desired `max` item count.","status":"published","published":"2026-05-18T16:22:01Z","modified":"2026-09-10T03:51:06.302870102Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"RHSA-2026:13874","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-16T10:04:16Z","modified":"2026-10-16T10:11:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:17682","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-28T10:06:14Z","modified":"2026-10-17T10:09:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:22380","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-18T10:08:10Z","modified":"2026-10-20T10:06:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:22934","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-18T10:08:21Z","modified":"2026-10-20T10:06:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:24069","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-19T10:06:07Z","modified":"2026-10-16T10:13:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:7378","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:52Z","modified":"2026-10-20T10:15:20Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7387","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:53Z","modified":"2026-10-16T10:25:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7634","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-19T10:08:32Z","modified":"2026-10-16T10:25:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7655","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:32Z","modified":"2026-10-20T10:15:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:9455","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:51Z","modified":"2026-10-19T10:08:10Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"ROOT-APP-NPM-CVE-2026-45149","title":"CVE-2026-45149 in brace-expansion - Patched by Root","description":"Root has patched CVE-2026-45149 in the brace-expansion package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T08:31:49Z","modified":"2026-10-08T09:15:23.138814525Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-45149","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.","status":"published","published":"2026-05-29T20:16:00Z","modified":"2026-10-17T12:58:22.638573328Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"CLSA-2026-1791215768","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.5-tuxcare.1.","status":"published","published":"2026-10-05T15:56:08Z","modified":"2026-10-15T09:47:35.54999258Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791226577","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.4-tuxcare.1.","status":"published","published":"2026-10-05T18:56:17Z","modified":"2026-10-15T09:47:35.515791887Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792453589","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.","status":"published","published":"2026-10-19T23:46:29Z","modified":"2026-10-20T01:45:14.461302451Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479350","title":"TuxCare security update for brace-expansion (7 CVEs)","description":"TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.","status":"published","published":"2026-10-20T06:55:50Z","modified":"2026-10-20T13:45:06.057962897Z","updated_at":"2026-11-02T15:43:54.378946Z"}]}}