{"id":"CVE-2026-67214","aliases":["CLSA-2026-1790609840","CLSA-2026-1790622758","CLSA-2026-1790622992","CLSA-2026-1790673732","CLSA-2026-1791196334","CLSA-2026-1791396501","CLSA-2026-1791626324","CLSA-2026-1791626479","CLSA-2026-1791626714","CLSA-2026-1791806453","CLSA-2026-1792232027","DEBIAN-CVE-2026-67214","EUVD-2026-50326","GHSA-28wg-ghj8-5hjv","RHSA-2026:48241","RHSA-2026:48320","RHSA-2026:59030","RHSA-2026:71113","ROOT-APP-NPM-CVE-2026-67214","UBUNTU-CVE-2026-67214"],"status":"published","title":"nanoid Infinite Loop via Negative Size in non-secure module","description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0033,"percentile":0.26439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-07-29T13:32:02Z","modified":"2026-10-31T02:30:46Z","fixes":[{"ecosystem":"npm","package":"nanoid","fixed_in":["3.3.16","5.1.16"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nanoid","fixed_in":["3.3.14-tuxcare.1","5.1.15-tuxcare.1","5.1.11-tuxcare.1","3.3.11-tuxcare.2","5.1.5-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-mocha","fixed_in":["9.1.4+ds1+~cs28.2.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-mocha","fixed_in":["9.1.4+ds1+~cs28.2.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-mocha","fixed_in":["9.1.4+ds1+~cs28.2.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-postcss","fixed_in":["8.5.15+~cs9.3.39-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"jaeger","fixed_in":["0:2.20.0-0.7.hum1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"nanoid","fixed_in":["3.3.4-aikido.2","3.3.4-aikido.1","3.3.11-aikido.2","3.3.8-aikido.2","3.3.7-aikido.3","3.3.11-aikido.1","3.3.12-aikido.1","3.3.13-aikido.1","3.3.15-aikido.1","3.3.8-aikido.1","3.3.7-aikido.1","3.3.7-aikido.2","3.1.20-aikido.5","3.3.16-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/nanoid","fixed_in":["3.3.4-root.io.2","3.3.4-root.io.1","3.3.11-root.io.2","3.3.8-root.io.2","3.3.7-root.io.3","3.3.11-root.io.1","3.3.12-root.io.1","3.3.13-root.io.1","3.3.15-root.io.1","3.3.8-root.io.1","3.3.7-root.io.1","3.3.7-root.io.2","3.1.20-root.io.5","3.3.16-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.1.16"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.7-tuxcare.0"},{"fixed":"3.3.7-tuxcare.2"}]}],"versions":["3.3.7","3.3.7-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.14-tuxcare.0"},{"fixed":"3.3.14-tuxcare.1"}]}],"versions":["3.3.14"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.15-tuxcare.0"},{"fixed":"5.1.15-tuxcare.1"}]}],"versions":["5.1.15"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.11-tuxcare.0"},{"fixed":"5.1.11-tuxcare.1"}]}],"versions":["5.1.11"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.12-tuxcare.0"},{"fixed":"3.3.12-tuxcare.2"}]}],"versions":["3.3.12","3.3.12-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6-tuxcare.0"},{"fixed":"5.1.6-tuxcare.1"}]}],"versions":["5.1.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.6-tuxcare.0"},{"fixed":"3.3.6-tuxcare.2"}]}],"versions":["3.3.6","3.3.6-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.11-tuxcare.0"},{"fixed":"3.3.11-tuxcare.2"}]}],"versions":["3.3.11","3.3.11-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.4-tuxcare.0"},{"fixed":"3.3.4-tuxcare.2"}]}],"versions":["3.3.4","3.3.4-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.8-tuxcare.0"},{"fixed":"3.3.8-tuxcare.1"}]}],"versions":["3.3.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5-tuxcare.0"},{"fixed":"5.1.5-tuxcare.3"}]}],"versions":["5.1.5","5.1.5-tuxcare.1","5.1.5-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-mocha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.4+ds1+~cs28.2.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-mocha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.4+ds1+~cs28.2.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-mocha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.4+ds1+~cs28.2.8-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.20+~cs8.0.23-1","8.4.20+~cs8.0.23-1+deb12u1","8.4.31+~cs8.0.26-1","8.4.39+~cs9.2.29-1","8.4.49+~cs9.2.32-1","8.5.12+~cs9.3.32-1","8.5.14+~cs9.3.34-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1","8.5.19+~cs10.2.23-1","8.5.21+~cs10.2.23-1","8.5.23+~cs10.2.23-1","8.5.25+~cs10.2.23-1","8.5.26+~cs10.2.24-1","8.5.28+~cs10.2.24-1","8.5.31+~cs10.2.26-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.49+~cs9.2.32-1","8.5.12+~cs9.3.32-1","8.5.14+~cs9.3.34-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1","8.5.19+~cs10.2.23-1","8.5.21+~cs10.2.23-1","8.5.23+~cs10.2.23-1","8.5.25+~cs10.2.23-1","8.5.26+~cs10.2.24-1","8.5.28+~cs10.2.24-1","8.5.31+~cs10.2.26-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.15+~cs9.3.39-1"}]}],"versions":["8.4.49+~cs9.2.32-1","8.5.12+~cs9.3.32-1","8.5.14+~cs9.3.34-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"npm","package":"nanoid","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.16"}]}]},{"source":"osv","ecosystem":"npm","package":"nanoid","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"5.1.16"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.1-0.3.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"jaeger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.20.0-0.7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.0-0.1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-3.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python3-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python3-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.60-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Root:npm","package":"nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-aikido.2"},{"fixed":"3.3.4-aikido.1"},{"fixed":"3.3.11-aikido.2"},{"fixed":"3.3.8-aikido.2"},{"fixed":"3.3.7-aikido.3"},{"fixed":"3.3.11-aikido.1"},{"fixed":"3.3.12-aikido.1"},{"fixed":"3.3.13-aikido.1"},{"fixed":"3.3.15-aikido.1"},{"fixed":"3.3.8-aikido.1"},{"fixed":"3.3.7-aikido.1"},{"fixed":"3.3.7-aikido.2"},{"fixed":"3.1.20-aikido.5"},{"fixed":"3.3.16-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/nanoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-root.io.2"},{"fixed":"3.3.4-root.io.1"},{"fixed":"3.3.11-root.io.2"},{"fixed":"3.3.8-root.io.2"},{"fixed":"3.3.7-root.io.3"},{"fixed":"3.3.11-root.io.1"},{"fixed":"3.3.12-root.io.1"},{"fixed":"3.3.13-root.io.1"},{"fixed":"3.3.15-root.io.1"},{"fixed":"3.3.8-root.io.1"},{"fixed":"3.3.7-root.io.1"},{"fixed":"3.3.7-root.io.2"},{"fixed":"3.1.20-root.io.5"},{"fixed":"3.3.16-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.23-1","6.0.23-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2.1+~cs5.3.23-8","8.4.5+~cs7.1.51-2","8.4.6+~cs7.3.21-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.20+~cs8.0.23-1","8.4.31+~cs8.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1"]}],"products":[{"vendor":"nanoid_project","product":"nanoid"}],"references":[{"url":"https://github.com/ai/nanoid/releases/tag/5.1.16","tags":["release-notes","Product","Release Notes","advisory","web","article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.16","tags":["release-notes","Product","Release Notes","advisory"]},{"url":"https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","tags":["patch","Patch","fix","web","article"]},{"url":"https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","tags":["third-party-advisory","Patch","Release Notes","Third Party Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/pull/600","tags":["web"]},{"url":"https://github.com/ai/nanoid/pull/601","tags":["web"]},{"url":"https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28wg-ghj8-5hjv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67214.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-67214","tags":["advisory"]},{"url":"https://github.com/ai/nanoid","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48241","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67213","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67214","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67321","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67312","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67320","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48241.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67213","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.6","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508411","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67214","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67312","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67320","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510011","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67321","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48320","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48320.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73501","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59030.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73501","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73501","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.144.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71113","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530744","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71113.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12564","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54284","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71458","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71459","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71460","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71462","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71463","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71463","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71463","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71464","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71465","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71465","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71491","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71491","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75838","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75884","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75884","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/pull/797","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84470","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84470","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84470","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84474","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84474","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84486","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84499","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84502","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84638","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84643","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84679","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84680","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84683","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84683","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84684","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84686","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84689","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84689","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84703","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84703","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84706","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84707","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84708","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84709","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84709","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84711","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84711","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84712","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84714","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84716","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84718","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84719","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84720","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84724","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87819","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530742","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87819","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-67214","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-67214","title":"nanoid Infinite Loop via Negative Size in non-secure module","description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","status":"published","published":"2026-07-29T13:32:02.265Z","modified":"2026-10-29T21:16:30.083Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-50326","description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","status":"published","published":"2026-07-29T13:32:02Z","modified":"2026-10-29T21:16:30Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:13.894662Z"}],"ghsa":[{"id":"GHSA-28wg-ghj8-5hjv","title":"nanoid: non-secure generators can loop indefinitely with negative size","description":"nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","status":"published","published":"2026-07-29T15:31:12Z","modified":"2026-08-07T20:53:01Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:40:58.888637Z"}],"nvd":[{"id":"CVE-2026-67214","description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","status":"published","published":"2026-07-29T14:16:35.043Z","modified":"2026-10-29T21:17:29.87Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-67214","title":"nanoid Infinite Loop via Negative Size in non-secure module","description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","status":"published","published":"2026-07-29T13:32:02.265Z","modified":"2026-10-31T02:30:46.276132674Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-67214","description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","status":"published","published":"2026-07-29T14:16:35.043Z","modified":"2026-10-30T09:49:10.815029544Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"GHSA-28wg-ghj8-5hjv","title":"nanoid: non-secure generators can loop indefinitely with negative size","description":"nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","status":"published","published":"2026-07-29T15:31:12Z","modified":"2026-09-10T03:50:51.191256883Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"RHSA-2026:48241","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-05T10:36:40Z","modified":"2026-10-20T10:09:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48320","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-20T10:18:13Z","modified":"2026-10-16T10:18:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:59030","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-27T10:15:40Z","modified":"2026-10-16T10:20:52Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:71113","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-09-24T10:15:15Z","modified":"2026-10-20T10:14:50Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-67214","description":"nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.","status":"published","published":"2026-07-29T14:16:00Z","modified":"2026-09-02T19:36:36.318417174Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"CLSA-2026-1790609840","title":"TuxCare security update for nanoid (4 CVEs)","description":"TuxCare rebuilt nanoid to address 4 CVEs. Fixed in 3.3.7-tuxcare.2.","status":"published","published":"2026-09-28T15:37:20Z","modified":"2026-10-15T09:48:03.992431985Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790622758","title":"TuxCare security update for nanoid (1 CVE)","description":"TuxCare rebuilt nanoid to address 1 CVE. Fixed in 3.3.14-tuxcare.1.","status":"published","published":"2026-09-28T19:12:38Z","modified":"2026-10-15T09:47:38.429701354Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790622992","title":"TuxCare security update for nanoid (1 CVE)","description":"TuxCare rebuilt nanoid to address 1 CVE. Fixed in 5.1.15-tuxcare.1.","status":"published","published":"2026-09-28T19:16:32Z","modified":"2026-10-15T09:48:04.010462798Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790673732","title":"TuxCare security update for nanoid (1 CVE)","description":"TuxCare rebuilt nanoid to address 1 CVE. Fixed in 5.1.11-tuxcare.1.","status":"published","published":"2026-09-29T09:22:12Z","modified":"2026-10-15T09:48:03.20263694Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791196334","title":"TuxCare security update for nanoid (2 CVEs)","description":"TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.12-tuxcare.2.","status":"published","published":"2026-10-05T10:32:14Z","modified":"2026-10-15T09:47:39.241336899Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791396501","title":"TuxCare security update for nanoid (2 CVEs)","description":"TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 5.1.6-tuxcare.1.","status":"published","published":"2026-10-07T18:08:21Z","modified":"2026-10-15T09:47:39.588120509Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791626324","title":"TuxCare security update for nanoid (2 CVEs)","description":"TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.6-tuxcare.2.","status":"published","published":"2026-10-10T09:58:44Z","modified":"2026-10-15T09:48:04.413590362Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791626479","title":"TuxCare security update for nanoid (1 CVE)","description":"TuxCare rebuilt nanoid to address 1 CVE. Fixed in 3.3.11-tuxcare.2.","status":"published","published":"2026-10-10T10:01:19Z","modified":"2026-10-15T09:48:04.494065141Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791626714","title":"TuxCare security update for nanoid (2 CVEs)","description":"TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.4-tuxcare.2.","status":"published","published":"2026-10-10T10:05:14Z","modified":"2026-10-15T09:48:04.461222635Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806453","title":"TuxCare security update for nanoid (2 CVEs)","description":"TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.8-tuxcare.1.","status":"published","published":"2026-10-12T12:00:53Z","modified":"2026-10-15T09:47:40.182227822Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792232027","title":"TuxCare security update for nanoid (1 CVE)","description":"TuxCare rebuilt nanoid to address 1 CVE. Fixed in 5.1.5-tuxcare.3.","status":"published","published":"2026-10-17T10:13:47Z","modified":"2026-10-17T13:09:26.494257836Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"ROOT-APP-NPM-CVE-2026-67214","title":"CVE-2026-67214 in nanoid - Patched by Root","description":"Root has patched CVE-2026-67214 in the nanoid package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-11T11:33:25Z","modified":"2026-09-11T12:15:03.057930467Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}