{"id":"CVE-2026-45736","aliases":["CLSA-2026-1784596293","CLSA-2026-1784596324","CLSA-2026-1785380881","CLSA-2026-1788560406","CLSA-2026-1790200934","CLSA-2026-1790202672","CLSA-2026-1790413013","CLSA-2026-1790541916","CLSA-2026-1790541935","CLSA-2026-1790610738","CLSA-2026-1792448229","DEBIAN-CVE-2026-45736","EUVD-2026-30543","GHSA-58qx-3vcg-4xpx","RHSA-2026:26638","RHSA-2026:26994","RHSA-2026:27171","RHSA-2026:57590","RHSA-2026:7655","ROOT-APP-NPM-CVE-2026-45736","UBUNTU-CVE-2026-45736","openSUSE-SU-2026:11705-1","openSUSE-SU-2026:11952-1","openSUSE-SU-2026:21849-1"],"status":"published","title":"ws: Uninitialized memory disclosure","description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00745,"percentile":0.55231,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-824","CWE-908"],"published":"2026-05-04T10:11:32Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"npm","package":"ws","fixed_in":["8.20.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"ws","fixed_in":["8.20.0-tuxcare.1","8.18.0-tuxcare.1","8.11.0-tuxcare.2","8.5.0-tuxcare.2","8.2.3-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-ws","fixed_in":["8.20.1+~cs14.19.1-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"ws","fixed_in":["8.18.0-aikido.1","8.19.0-aikido.1","8.18.2-aikido.1","8.20.0-aikido.1","8.17.1-aikido.1","8.17.1-aikido.2","8.18.1-aikido.1","8.18.0-aikido.2","8.18.2-aikido.2","8.19.0-aikido.2","8.20.0-aikido.2","8.13.0-aikido.1","8.18.1-aikido.2","8.13.0-aikido.2","8.17.1-aikido.3","8.18.3-aikido.2","8.20.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/ws","fixed_in":["8.18.0-root.io.1","8.19.0-root.io.1","8.18.2-root.io.1","8.20.0-root.io.1","8.17.1-root.io.1","8.17.1-root.io.2","8.18.1-root.io.1","8.18.0-root.io.2","8.18.2-root.io.2","8.19.0-root.io.2","8.20.0-root.io.2","8.13.0-root.io.1","8.18.1-root.io.2","8.13.0-root.io.2","8.17.1-root.io.3","8.18.3-root.io.2","8.20.1-root.io.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"zcode","fixed_in":["3.14.3-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.20.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.20.0-tuxcare.0"},{"fixed":"8.20.0-tuxcare.1"}]}],"versions":["8.20.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.0-tuxcare.0"},{"fixed":"8.18.0-tuxcare.1"}]}],"versions":["8.18.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.16.0-tuxcare.0"},{"fixed":"8.16.0-tuxcare.2"}]}],"versions":["8.16.0","8.16.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0-tuxcare.0"},{"fixed":"8.13.0-tuxcare.1"}]}],"versions":["8.13.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0-tuxcare.0"},{"fixed":"8.11.0-tuxcare.2"}]}],"versions":["8.11.0","8.11.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0-tuxcare.0"},{"fixed":"8.5.0-tuxcare.2"}]}],"versions":["8.5.0","8.5.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.3-tuxcare.0"},{"fixed":"8.2.3-tuxcare.2"}]}],"versions":["8.2.3","8.2.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.3-tuxcare.0"},{"fixed":"8.18.3-tuxcare.1"}]}],"versions":["8.18.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.17.1-tuxcare.0"},{"fixed":"8.17.1-tuxcare.1"}]}],"versions":["8.17.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.2-tuxcare.0"},{"fixed":"8.14.2-tuxcare.1"}]}],"versions":["8.14.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.18.2-tuxcare.0"},{"fixed":"8.18.2-tuxcare.1"}]}],"versions":["8.18.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.11.0+~cs13.7.3-1","8.11.0+~cs13.7.3-2","8.18.0+~cs13.7.11-1","8.18.0+~cs14.5.15-1","8.18.1+~cs14.18.2-1","8.19.0+~cs14.19.1-1","8.20.1+~cs14.19.1-1","8.21.0+~cs14.19.1-1","8.21.1+~cs14.19.1-1","8.21.3+~cs14.19.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.18.1+~cs14.18.2-1","8.19.0+~cs14.19.1-1","8.20.1+~cs14.19.1-1","8.21.0+~cs14.19.1-1","8.21.1+~cs14.19.1-1","8.21.3+~cs14.19.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.1+~cs14.19.1-1"}]}],"versions":["8.18.1+~cs14.18.2-1","8.19.0+~cs14.19.1-1"]},{"source":"osv","ecosystem":"npm","package":"ws","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.20.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.109-1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-10.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.109-1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-aot-10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.109-1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-dbg-10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.109-1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-templates-10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.109-1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.109-1.hum1"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-9.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.118-1.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-9.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.118-1.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-aot-9.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.118-1.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-dbg-9.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.118-1.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-templates-9.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.118-1.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet9.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.118-1.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"netstandard-targeting-pack-2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.118-1.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rh-podman-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.2-1.el10_2"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.22-18.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-aikido.1"},{"fixed":"8.19.0-aikido.1"},{"fixed":"8.18.2-aikido.1"},{"fixed":"8.20.0-aikido.1"},{"fixed":"8.17.1-aikido.1"},{"fixed":"8.17.1-aikido.2"},{"fixed":"8.18.1-aikido.1"},{"fixed":"8.18.0-aikido.2"},{"fixed":"8.18.2-aikido.2"},{"fixed":"8.19.0-aikido.2"},{"fixed":"8.20.0-aikido.2"},{"fixed":"8.13.0-aikido.1"},{"fixed":"8.18.1-aikido.2"},{"fixed":"8.13.0-aikido.2"},{"fixed":"8.17.1-aikido.3"},{"fixed":"8.18.3-aikido.2"},{"fixed":"8.20.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0-root.io.1"},{"fixed":"8.19.0-root.io.1"},{"fixed":"8.18.2-root.io.1"},{"fixed":"8.20.0-root.io.1"},{"fixed":"8.17.1-root.io.1"},{"fixed":"8.17.1-root.io.2"},{"fixed":"8.18.1-root.io.1"},{"fixed":"8.18.0-root.io.2"},{"fixed":"8.18.2-root.io.2"},{"fixed":"8.19.0-root.io.2"},{"fixed":"8.20.0-root.io.2"},{"fixed":"8.13.0-root.io.1"},{"fixed":"8.18.1-root.io.2"},{"fixed":"8.13.0-root.io.2"},{"fixed":"8.17.1-root.io.3"},{"fixed":"8.18.3-root.io.2"},{"fixed":"8.20.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.2+ds1.349b7460-1","1.0.1+ds1.e6ddaae4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0+ds1.e6ddaae4-3build1","1.1.0+ds1.e6ddaae4-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0+ds1.e6ddaae4-5","7.2.1-2","7.2.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.2+~cs18.0.8-2","7.5.5+~cs13.0.13-1","8.5.0+~cs13.3.3-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.11.0+~cs13.7.3-1","8.11.0+~cs13.7.3-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.18.0+~cs14.5.15-1","8.18.1+~cs14.18.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.19.0+~cs14.19.1-1","8.20.1+~cs14.19.1-1","8.21.3+~cs14.19.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.18.1+~cs14.18.2-1","8.19.0+~cs14.19.1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kimi-code","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kimi-code","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.42.0-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"cryostat 4 on rhel 9"},{"vendor":"red hat","product":"gatekeeper 3"},{"vendor":"red hat","product":"node healthcheck operator"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 2"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat amq broker 7.13.6"},{"vendor":"red hat","product":"red hat amq broker 7.14.1"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of podman desktop"},{"vendor":"red hat","product":"red hat build of podman desktop - tech preview"},{"vendor":"red hat","product":"red hat connectivity link 1"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat developer hub 1.10"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat migration toolkit 1.8"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.4"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"},{"vendor":"red hat","product":"red hat openshift data foundation 4.18"},{"vendor":"red hat","product":"red hat openshift data foundation 4.19"},{"vendor":"red hat","product":"red hat openshift data foundation 4.20"},{"vendor":"red hat","product":"red hat openshift data foundation 4.22"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.29"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.4"},{"vendor":"red hat","product":"self-service automation portal 2"},{"vendor":"websockets","product":"ws"},{"vendor":"ws_project","product":"ws"}],"references":[{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["x_refsource_CONFIRM","exploit","Exploit","Patch","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34374","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36754","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26638","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26994","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27171","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7655","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44235","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44263","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44267","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40792","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48693","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40768","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56431","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56366","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57013","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56928","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-58qx-3vcg-4xpx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45736.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws","tags":["package"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45591","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45491","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50527","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50526","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50524","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50648","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50525","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50528","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47302","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57108","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50651","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56170","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50659","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47303","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47300","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26638.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45491","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45591","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45591","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500492","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47300","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47300","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500515","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47302","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47303","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500593","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50524","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500580","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50525","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50526","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500581","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50527","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50527","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500562","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50528","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500587","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50648","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499217","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50651","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500589","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50659","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500189","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56170","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57108","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59724","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26994.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59724","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c","tags":["article"]},{"url":"https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7","tags":["article"]},{"url":"https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50646","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50649","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50650","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27171.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50646","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50646","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50649","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500556","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50650","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510801","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-238929","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/facebook/create-react-app/pull/7444","tags":["article"]},{"url":"https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/pull/4316","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","tags":["advisory"]},{"url":"https://cwe.mitre.org/data/definitions/93.html","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","tags":["article"]},{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","tags":["article"]},{"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","tags":["article"]},{"url":"https://www.npmjs.com/package/form-data","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["article"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","tags":["article"]},{"url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42338","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42570","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.8.1","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","tags":["advisory"]},{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45740","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48068","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","tags":["advisory"]},{"url":"https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","tags":["article"]},{"url":"https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.7","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56876","tags":["advisory"]},{"url":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","tags":["article"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.19","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59877","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/pull/2352","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2950","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45149","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7655.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-45736","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48779","tags":["web"]},{"url":"https://bugzilla.suse.com/1268927","tags":["report"]},{"url":"https://bugzilla.suse.com/1269951","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-45736","title":"ws: Uninitialized memory disclosure","description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","status":"published","published":"2026-05-15T14:53:57.263Z","modified":"2026-09-11T12:09:09.123Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-908","CWE-824"],"updated_at":"2026-11-02T13:46:32.755125Z"}],"euvd":[{"id":"EUVD-2026-30543","description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","status":"published","published":"2026-05-15T14:53:57Z","modified":"2026-09-11T12:09:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:22.994693Z"}],"ghsa":[{"id":"GHSA-58qx-3vcg-4xpx","title":"ws: Uninitialized memory disclosure","description":"### Impact\n\nThe `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument.\n\n### Proof of concept\n\n```js\nimport { deepStrictEqual } from 'node:assert';\nimport { WebSocket, WebSocketServer } from 'ws';\n\nconst wss = new WebSocketServer(\n  { port: 0, skipUTF8Validation: true },\n  function () {\n    const { port } = wss.address();\n    const ws = new WebSocket(`ws://localhost:${port}`, {\n      skipUTF8Validation: true\n    });\n\n    ws.on('close', function (code, reason) {\n      deepStrictEqual(reason, Buffer.alloc(80));\n    });\n  }\n);\n\nwss.on('connection', function (ws) {\n  ws.close(1000, new Float32Array(20));\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.20.1 (https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086).\n\n### Credits\n\nCredit for the private and responsible disclosure of this issue goes to [Nikita Skovoroda](https://github.com/ChALkeR).\n\n### Remarks\n\nAlthough the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.\n\n### Resources\n\n- https://github.com/advisories/GHSA-58qx-3vcg-4xpx\n- https://www.cve.org/CVERecord?id=CVE-2026-45736","status":"published","published":"2026-05-18T19:02:40Z","modified":"2026-05-18T19:02:42Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:40:11.298154Z"}],"nvd":[{"id":"CVE-2026-45736","description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","status":"published","published":"2026-05-15T15:16:54.103Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-908","CWE-824"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-45736","title":"ws: Uninitialized memory disclosure","description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","status":"published","published":"2026-05-15T14:53:57.263Z","modified":"2026-11-11T10:30:50.02889114Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-11T11:06:46.44415Z"},{"id":"DEBIAN-CVE-2026-45736","description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","status":"published","published":"2026-05-15T15:16:54.103Z","modified":"2026-10-27T09:47:39.44388528Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-58qx-3vcg-4xpx","title":"ws: Uninitialized memory disclosure","description":"### Impact\n\nThe `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument.\n\n### Proof of concept\n\n```js\nimport { deepStrictEqual } from 'node:assert';\nimport { WebSocket, WebSocketServer } from 'ws';\n\nconst wss = new WebSocketServer(\n  { port: 0, skipUTF8Validation: true },\n  function () {\n    const { port } = wss.address();\n    const ws = new WebSocket(`ws://localhost:${port}`, {\n      skipUTF8Validation: true\n    });\n\n    ws.on('close', function (code, reason) {\n      deepStrictEqual(reason, Buffer.alloc(80));\n    });\n  }\n);\n\nwss.on('connection', function (ws) {\n  ws.close(1000, new Float32Array(20));\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.20.1 (https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086).\n\n### Credits\n\nCredit for the private and responsible disclosure of this issue goes to [Nikita Skovoroda](https://github.com/ChALkeR).\n\n### Remarks\n\nAlthough the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.\n\n### Resources\n\n- https://github.com/advisories/GHSA-58qx-3vcg-4xpx\n- https://www.cve.org/CVERecord?id=CVE-2026-45736","status":"published","published":"2026-05-18T19:02:40Z","modified":"2026-09-10T03:51:04.572514669Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"RHSA-2026:26638","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-18T10:10:00Z","modified":"2026-10-20T10:06:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26994","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-18T10:10:03Z","modified":"2026-10-20T10:06:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:27171","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-19T10:06:58Z","modified":"2026-10-20T10:06:48Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","status":"published","published":"2026-08-21T10:14:02Z","modified":"2026-10-20T10:11:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:7655","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:32Z","modified":"2026-10-20T10:15:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-APP-NPM-CVE-2026-45736","title":"CVE-2026-45736 in ws - Patched by Root","description":"Root has patched CVE-2026-45736 in the ws package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-28T07:01:18Z","modified":"2026-09-28T08:15:05.99107482Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-45736","description":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.","status":"published","published":"2026-05-15T15:16:00Z","modified":"2026-10-17T12:58:22.751284798Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"CLSA-2026-1784596293","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 8.20.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:54.116922291Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784596324","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 8.18.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:36.272181974Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785380881","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.16.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:48:03.888669964Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1788560406","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 8.13.0-tuxcare.1.","status":"published","published":"2026-09-04T22:20:06Z","modified":"2026-10-15T09:48:03.103097262Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790200934","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 8.11.0-tuxcare.2.","status":"published","published":"2026-09-23T22:02:14Z","modified":"2026-10-15T09:48:03.107071907Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790202672","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 8.5.0-tuxcare.2.","status":"published","published":"2026-09-23T22:31:12Z","modified":"2026-10-15T09:47:56.461971727Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790413013","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 8.2.3-tuxcare.2.","status":"published","published":"2026-09-26T08:56:53Z","modified":"2026-10-15T09:47:56.701705704Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790541916","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.18.3-tuxcare.1.","status":"published","published":"2026-09-27T20:45:16Z","modified":"2026-10-15T09:47:38.162582528Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790541935","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.17.1-tuxcare.1.","status":"published","published":"2026-09-27T20:45:35Z","modified":"2026-10-15T09:47:37.970591824Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790610738","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.14.2-tuxcare.1.","status":"published","published":"2026-09-28T15:52:18Z","modified":"2026-10-15T09:47:08.152041075Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792448229","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.18.2-tuxcare.1.","status":"published","published":"2026-10-19T22:17:09Z","modified":"2026-10-20T01:45:11.694267474Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"openSUSE-SU-2026:11705-1","title":"kimi-code-0.41.0-1.1 on GA media","description":"These are all security issues fixed in the kimi-code-0.41.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:06.471052842Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11952-1","title":"zcode-3.14.3-1.1 on GA media","description":"These are all security issues fixed in the zcode-3.14.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-02T18:23:14.066649856Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21849-1","title":"Security update for kimi-code","description":"This update for kimi-code fixes the following issues:\n\nChanges in kimi-code:\n\nUpdate to version 0.42.0:\n\n  * Add an experimental Updates panel with paginated progress\n    messages from the main agent and subagents, enabled with\n    KIMI_CODE_EXPERIMENTAL_NOTIFY_USER=1\n  * Turn the subagent model pool, Remote Control and the minidb\n    session-index read model with the global search worker always\n    on; their experimental flags and opt-out variables are gone,\n    search persistence is now tuned via the [database] section\n  * Give tower worker and reviewer briefings the full mission\n    context, follow the subagent timeout for tower agents, and\n    show each background agent's model in /tasks\n  * Retrieve file search matches beyond the first 100 results,\n    accept HEIC, HEIF and BMP images with Kimi-served models,\n    and warn in kimi -p when project MCP servers are skipped in\n    an untrusted folder\n  * Read files with configurable character limits and resumable\n    long-line reads, decode malformed UTF-16 with a warning, and\n    preserve image and video filenames in session history\n  * Rework the dashboard: deletable sessions, reorderable media\n    rail, collapsed tool calls revealed with Ctrl-O, and less\n    jank on long conversations and session reloads\n\nUpdate to version 0.41.0:\n\n  * Add experimental tower mode for multi-agent orchestration and\n    Remote Control for reaching a local web session remotely\n  * Add the WaitFor tool so the agent can wait for a background\n    task inside the current turn, and an optional fork parameter\n    that starts a subagent from a snapshot of the caller's history\n  * Support two OAuth login methods, kimi.ai and kimi.com, and\n    activate several skills in one prompt\n  * Enable the subagent model pool in every launch mode by default\n    and make turn-level file history unconditional\n  * Add a dangerous-command guard that always asks before shutdown,\n    reboot or rm -rf in manual and YOLO permission modes, disabled\n    with [permission] dangerous_command_guard; auto mode never\n    blocks\n  * Remove kimi web --allow-remote-terminals; PTY terminal routes\n    are served on loopback binds only\n  * Require Edit and Write to read a file first, and reject a write\n    when the file changed on disk since that read\n  * Rework the bundled web dashboard: multi-tab right sidebar,\n    Open/Done/Workspaces session tabs, a plugin marketplace panel\n    and mobile bottom sheets\n  * ... see upstream's release notes for the full list\n- Vendor the runtime dependencies upstream stopped inlining in\n  0.39.0:\n  * Add ws, qrcode and qrcode's own pngjs and dijkstrajs as\n    sources, installed into the package's private node_modules\n  * Unpack the npm tarball directly instead of running npm install,\n    which would resolve the new dependencies against the registry\n    and pull in qrcode's CLI-only yargs tree\n  * Declare the vendored trees with Provides: bundled(...)\n- CVE-2026-48779: ws denial of service from a high volume of tiny\n  WebSocket fragments; the ws inlined in the old bundle predated\n  the 8.21.0 fix, the vendored ws is 8.21.3 (boo#1268927)\n- CVE-2026-45736: ws uninitialized memory disclosure via\n  websocket.close() with a TypedArray, fixed by the same ws version\n  (boo#1269951)\n- Load the compiled node-pty addon during the build check as well\n","status":"published","published":"2026-09-14T13:20:22Z","modified":"2026-09-15T17:00:06.110660287Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}