Every CVESearch/Get API key

CVE-2026-102276

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

7.5 HighFix available

CVE-2026-102276 is a high vulnerability (CVSS 7.5) in Juliangruber Brace-expansion, published September 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in brace-expansion 5.0.10.

What does this mean?
Severity
7.5 HighCVSS 3.1, CVE List
Exploit chance
0.46%EPSS, 40th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
5.0.10brace-expansion +281 more

Description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.46%Up 0.1 points since Sep 29, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
brace-expansion
npm
4.0.0 up to 5.0.10
5.0.10
brace-expansion
npm
3.0.0 up to 3.0.7
3.0.7
brace-expansion
npm
2.0.0 up to 2.1.5
2.1.5
brace-expansion
npm
before 1.1.19
1.1.19
nodejs
AlmaLinux:8
From an advisory covering 13 CVEs
before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-devel
AlmaLinux:8
From an advisory covering 13 CVEs
before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-docs
AlmaLinux:8
From an advisory covering 13 CVEs
before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 13 CVEs
before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-libs
AlmaLinux:8
From an advisory covering 13 CVEs
before 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-nodemon
AlmaLinux:8
From an advisory covering 13 CVEs
before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
Show 272 moreShow less
Affected packages
PackageAffectedFixed
nodejs-packaging
AlmaLinux:8
From an advisory covering 13 CVEs
before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 13 CVEs
before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 13 CVEs
before 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
v8-13.6-devel
AlmaLinux:8
From an advisory covering 13 CVEs
before 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
nodejs
AlmaLinux:9
From an advisory covering 13 CVEs
before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-devel
AlmaLinux:9
From an advisory covering 13 CVEs
before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-docs
AlmaLinux:9
From an advisory covering 13 CVEs
before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 13 CVEs
before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-libs
AlmaLinux:9
From an advisory covering 13 CVEs
before 1:24.22.1-3.module_el9.8.0+333+788f3075
1:24.22.1-3.module_el9.8.0+333+788f3075
nodejs-nodemon
AlmaLinux:9
From an advisory covering 13 CVEs
before 3.1.14-3.module_el9.8.0+292+f4eaf8b2
3.1.14-3.module_el9.8.0+292+f4eaf8b2
nodejs-packaging
AlmaLinux:9
From an advisory covering 13 CVEs
before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 13 CVEs
before 2021.06-6.module_el9.7.0+209+ecf6523e
2021.06-6.module_el9.7.0+209+ecf6523e
npm
AlmaLinux:9
From an advisory covering 13 CVEs
before 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
v8-13.6-devel
AlmaLinux:9
From an advisory covering 13 CVEs
before 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075
nodejs24
AlmaLinux:10
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-devel
AlmaLinux:10
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-docs
AlmaLinux:10
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-full-i18n
AlmaLinux:10
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-libs
AlmaLinux:10
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-npm
AlmaLinux:10
From an advisory covering 9 CVEs
before 2:11.19.1-1.24.22.1.3.el10_2
2:11.19.1-1.24.22.1.3.el10_2
nodejs
AlmaLinux:10
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-devel
AlmaLinux:10
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-docs
AlmaLinux:10
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-full-i18n
AlmaLinux:10
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-libs
AlmaLinux:10
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-npm
AlmaLinux:10
From an advisory covering 8 CVEs
before 1:10.9.9-1.22.23.4.1.el10_2
1:10.9.9-1.22.23.4.1.el10_2
nodejs-packaging
AlmaLinux:9
From an advisory covering 7 CVEs
before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 7 CVEs
before 2021.06-6.module_el9.7.0+227+12323393
2021.06-6.module_el9.7.0+227+12323393
nodejs-nodemon
AlmaLinux:10
From an advisory covering 2 CVEs
before 3.1.14-5.el10_2
3.1.14-5.el10_2
nodejs
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:24.22.1-2.module_el8.10.0+4355+47fd9055
1:24.22.1-2.module_el8.10.0+4355+47fd9055
nodejs-devel
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:24.22.1-2.module_el8.10.0+4355+47fd9055
1:24.22.1-2.module_el8.10.0+4355+47fd9055
nodejs-docs
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:24.22.1-2.module_el8.10.0+4355+47fd9055
1:24.22.1-2.module_el8.10.0+4355+47fd9055
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:24.22.1-2.module_el8.10.0+4355+47fd9055
1:24.22.1-2.module_el8.10.0+4355+47fd9055
nodejs-libs
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:24.22.1-2.module_el8.10.0+4355+47fd9055
1:24.22.1-2.module_el8.10.0+4355+47fd9055
nodejs-nodemon
AlmaLinux:8
From an advisory covering 8 CVEs
before 3.1.14-2.module_el8.10.0+4250+09238ed4
3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 8 CVEs
before 2021.06-6.module_el8.10.0+4086+70facd4a
2021.06-6.module_el8.10.0+4086+70facd4a
npm
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:11.19.1-1.24.22.1.2.module_el8.10.0+4355+47fd9055
1:11.19.1-1.24.22.1.2.module_el8.10.0+4355+47fd9055
v8-13.6-devel
AlmaLinux:8
From an advisory covering 8 CVEs
before 3:13.6.233.17-1.24.22.1.2.module_el8.10.0+4355+47fd9055
3:13.6.233.17-1.24.22.1.2.module_el8.10.0+4355+47fd9055
nodejs
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:22.23.4-2.module_el8.10.0+4358+709b81be
1:22.23.4-2.module_el8.10.0+4358+709b81be
nodejs-devel
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:22.23.4-2.module_el8.10.0+4358+709b81be
1:22.23.4-2.module_el8.10.0+4358+709b81be
nodejs-docs
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:22.23.4-2.module_el8.10.0+4358+709b81be
1:22.23.4-2.module_el8.10.0+4358+709b81be
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:22.23.4-2.module_el8.10.0+4358+709b81be
1:22.23.4-2.module_el8.10.0+4358+709b81be
nodejs-libs
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:22.23.4-2.module_el8.10.0+4358+709b81be
1:22.23.4-2.module_el8.10.0+4358+709b81be
nodejs-nodemon
AlmaLinux:8
From an advisory covering 8 CVEs
before 3.1.14-3.module_el8.10.0+4358+709b81be
3.1.14-3.module_el8.10.0+4358+709b81be
nodejs-packaging
AlmaLinux:8
From an advisory covering 8 CVEs
before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 8 CVEs
before 2021.06-6.module_el8.10.0+4158+e796f37f
2021.06-6.module_el8.10.0+4158+e796f37f
npm
AlmaLinux:8
From an advisory covering 8 CVEs
before 1:10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be
1:10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be
v8-12.4-devel
AlmaLinux:8
From an advisory covering 8 CVEs
before 3:12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be
3:12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be
js-jquery
Azure Linux:3
through 3.5.0-4None known
nodejs-nodemon
Azure Linux:3
through 2.0.3-5None known
python-tensorboard
Azure Linux:3
through 2.16.2-6None known
brace-expansion
TuxCare:npm
4.0.1-tuxcare.0 up to 4.0.1-tuxcare.1, plus listed versions
4.0.1
4.0.1-tuxcare.1
brace-expansion
TuxCare:npm
2.0.2-tuxcare.0 up to 2.0.2-tuxcare.1, plus listed versions
2.0.2
2.0.2-tuxcare.1
brace-expansion
TuxCare:npm
1.1.18-tuxcare.0 up to 1.1.18-tuxcare.1, plus listed versions
1.1.18
1.1.18-tuxcare.1
brace-expansion
TuxCare:npm
1.1.16-tuxcare.0 up to 1.1.16-tuxcare.1, plus listed versions
1.1.16
1.1.16-tuxcare.1
brace-expansion
TuxCare:npm
1.1.15-tuxcare.0 up to 1.1.15-tuxcare.1, plus listed versions
1.1.15
1.1.15-tuxcare.1
brace-expansion
TuxCare:npm
1.1.14-tuxcare.0 up to 1.1.14-tuxcare.1, plus listed versions
1.1.14
1.1.14-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 3 CVEs
2.0.1-tuxcare.0 up to 2.0.1-tuxcare.4, plus listed versions
2.0.12.0.1-tuxcare.12.0.1-tuxcare.22.0.1-tuxcare.3
2.0.1-tuxcare.4
brace-expansion
TuxCare:npm
5.0.9-tuxcare.0 up to 5.0.9-tuxcare.1, plus listed versions
5.0.9
5.0.9-tuxcare.1
brace-expansion
TuxCare:npm
2.1.4-tuxcare.0 up to 2.1.4-tuxcare.1, plus listed versions
2.1.4
2.1.4-tuxcare.1
brace-expansion
TuxCare:npm
2.1.3-tuxcare.0 up to 2.1.3-tuxcare.2, plus listed versions
2.1.32.1.3-tuxcare.1
2.1.3-tuxcare.2
brace-expansion
TuxCare:npm
5.0.8-tuxcare.0 up to 5.0.8-tuxcare.2, plus listed versions
5.0.85.0.8-tuxcare.1
5.0.8-tuxcare.2
brace-expansion
TuxCare:npm
2.1.2-tuxcare.0 up to 2.1.2-tuxcare.3, plus listed versions
2.1.22.1.2-tuxcare.12.1.2-tuxcare.2
2.1.2-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
1.1.11-tuxcare.0 up to 1.1.11-tuxcare.3, plus listed versions
1.1.111.1.11-tuxcare.11.1.11-tuxcare.2
1.1.11-tuxcare.3
brace-expansion
TuxCare:npm
From an advisory covering 2 CVEs
5.0.4-tuxcare.0 up to 5.0.4-tuxcare.2, plus listed versions
5.0.45.0.4-tuxcare.1
5.0.4-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 6 CVEs
5.0.5-tuxcare.0 up to 5.0.5-tuxcare.2, plus listed versions
5.0.55.0.5-tuxcare.1
5.0.5-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 4 CVEs
1.1.12-tuxcare.0 up to 1.1.12-tuxcare.5, plus listed versions
1.1.121.1.12-tuxcare.11.1.12-tuxcare.21.1.12-tuxcare.3
1.1.12-tuxcare.5
brace-expansion
TuxCare:npm
From an advisory covering 6 CVEs
5.0.6-tuxcare.0 up to 5.0.6-tuxcare.1, plus listed versions
5.0.6
5.0.6-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 7 CVEs
5.0.3-tuxcare.0 up to 5.0.3-tuxcare.1, plus listed versions
5.0.3
5.0.3-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 7 CVEs
5.0.2-tuxcare.0 up to 5.0.2-tuxcare.1, plus listed versions
5.0.2
5.0.2-tuxcare.1
brace-expansion
TuxCare:npm
From an advisory covering 5 CVEs
1.1.3-tuxcare.0 up to 1.1.3-tuxcare.2, plus listed versions
1.1.31.1.3-tuxcare.1
1.1.3-tuxcare.2
brace-expansion
TuxCare:npm
From an advisory covering 2 CVEs
1.1.1-tuxcare.0 up to 1.1.1-tuxcare.1, plus listed versions
1.1.1
1.1.1-tuxcare.1
node-brace-expansion
Debian:12
All versions, plus listed versions
2.0.1+~1.1.0-12.0.1+~1.1.0-22.0.1-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
None known
node-brace-expansion
Debian:13
All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-12.1.7+~1.1.2-1
None known
node-brace-expansion
Debian:14
before 2.1.7+~1.1.2-1, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-12.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-1
2.1.7+~1.1.2-1
nodejs22
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:22.23.3-2.3.2.2.hum1
1:22.23.3-2.3.2.2.hum1
nodejs22-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:22.23.3-2.3.2.2.hum1
1:22.23.3-2.3.2.2.hum1
nodejs22-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:22.23.3-2.3.2.2.hum1
1:22.23.3-2.3.2.2.hum1
nodejs22-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:22.23.3-2.3.2.2.hum1
1:22.23.3-2.3.2.2.hum1
nodejs22-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:22.23.3-2.3.2.2.hum1
1:22.23.3-2.3.2.2.hum1
nodejs22-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:22.23.3-2.3.2.2.hum1
1:22.23.3-2.3.2.2.hum1
nodejs22-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:10.9.9-1.22.23.3.2.3.2.2.hum1
1:10.9.9-1.22.23.3.2.3.2.2.hum1
nodejs22-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:22.23.3-2.3.2.2.hum1
1:22.23.3-2.3.2.2.hum1
nodejs24
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:24.21.0-1.2.hum1
1:24.21.0-1.2.hum1
nodejs24-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:24.21.0-1.2.hum1
1:24.21.0-1.2.hum1
nodejs24-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:24.21.0-1.2.hum1
1:24.21.0-1.2.hum1
nodejs24-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:24.21.0-1.2.hum1
1:24.21.0-1.2.hum1
nodejs24-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:24.21.0-1.2.hum1
1:24.21.0-1.2.hum1
nodejs24-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:24.21.0-1.2.hum1
1:24.21.0-1.2.hum1
nodejs24-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 2:11.19.0-1.24.21.0.1.2.hum1
2:11.19.0-1.24.21.0.1.2.hum1
nodejs24-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 2:11.19.0-1.24.21.0.1.2.hum1
2:11.19.0-1.24.21.0.1.2.hum1
v8-13.6-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 3:13.6.233.17-1.24.21.0.1.2.hum1
3:13.6.233.17-1.24.21.0.1.2.hum1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:26.10.0-0.3.hum1
1:26.10.0-0.3.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:26.10.0-0.3.hum1
1:26.10.0-0.3.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:26.10.0-0.3.hum1
1:26.10.0-0.3.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:26.10.0-0.3.hum1
1:26.10.0-0.3.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:26.10.0-0.3.hum1
1:26.10.0-0.3.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:26.10.0-0.3.hum1
1:26.10.0-0.3.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:11.19.1-1.26.10.0.0.3.hum1
1:11.19.1-1.26.10.0.0.3.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
before 1:26.10.0-0.3.hum1
1:26.10.0-0.3.hum1
nodejs26
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-bin
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-devel
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-docs
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-full-i18n
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-libs
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
nodejs26-npm
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:11.20.0-1.26.11.1.0.4.hum1
0:11.20.0-1.26.11.1.0.4.hum1
nodejs26-npm-bin
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:26.11.1-0.4.hum1
0:26.11.1-0.4.hum1
v8-14.6-devel
Red Hat:hummingbird:1
From an advisory covering 9 CVEs
before 0:14.6.202.34-1.26.11.1.0.4.hum1
0:14.6.202.34-1.26.11.1.0.4.hum1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
1:24.22.1-1.module+el8.10.0+25218+d9e131cb
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
1:24.22.1-1.module+el8.10.0+25218+d9e131cb
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
1:24.22.1-1.module+el8.10.0+25218+d9e131cb
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
1:24.22.1-1.module+el8.10.0+25218+d9e131cb
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
1:24.22.1-1.module+el8.10.0+25218+d9e131cb
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
1:24.22.1-1.module+el8.10.0+25218+d9e131cb
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
1:24.22.1-1.module+el8.10.0+25218+d9e131cb
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-1.module+el8.10.0+25218+d9e131cb
1:24.22.1-1.module+el8.10.0+25218+d9e131cb
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 0:3.1.14-2.module+el8.10.0+24711+b610b202
0:3.1.14-2.module+el8.10.0+24711+b610b202
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb
1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 13 CVEs
before 3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb
3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
1:24.22.1-3.module+el9.8.0+25216+afa2a4a4
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 1:11.19.1-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4
1:11.19.1-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
before 3:13.6.233.17-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4
3:13.6.233.17-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4
nodejs24
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs24-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 9 CVEs
before 2:11.19.1-1.24.22.1.3.el10_2
2:11.19.1-1.24.22.1.3.el10_2
nodejs
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-full-i18n
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-npm
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:10.9.9-1.22.23.4.1.el10_2
1:10.9.9-1.22.23.4.1.el10_2
nodejs22
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs22-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs22-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:24.22.1-5.module+el9.8.0+25292+33251f3b
1:24.22.1-5.module+el9.8.0+25292+33251f3b
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:24.22.1-5.module+el9.8.0+25292+33251f3b
1:24.22.1-5.module+el9.8.0+25292+33251f3b
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:24.22.1-5.module+el9.8.0+25292+33251f3b
1:24.22.1-5.module+el9.8.0+25292+33251f3b
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:24.22.1-5.module+el9.8.0+25292+33251f3b
1:24.22.1-5.module+el9.8.0+25292+33251f3b
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:24.22.1-5.module+el9.8.0+25292+33251f3b
1:24.22.1-5.module+el9.8.0+25292+33251f3b
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:24.22.1-5.module+el9.8.0+25292+33251f3b
1:24.22.1-5.module+el9.8.0+25292+33251f3b
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:24.22.1-5.module+el9.8.0+25292+33251f3b
1:24.22.1-5.module+el9.8.0+25292+33251f3b
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:24.22.1-5.module+el9.8.0+25292+33251f3b
1:24.22.1-5.module+el9.8.0+25292+33251f3b
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 0:3.1.14-6.module+el9.8.0+25292+33251f3b
0:3.1.14-6.module+el9.8.0+25292+33251f3b
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 0:2021.06-6.module+el9.8.0+24708+e71d2e1d
0:2021.06-6.module+el9.8.0+24708+e71d2e1d
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b
1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b
v8-13.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b
3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:22.23.4-2.module+el9.8.0+25286+62e50b69
1:22.23.4-2.module+el9.8.0+25286+62e50b69
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:22.23.4-2.module+el9.8.0+25286+62e50b69
1:22.23.4-2.module+el9.8.0+25286+62e50b69
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:22.23.4-2.module+el9.8.0+25286+62e50b69
1:22.23.4-2.module+el9.8.0+25286+62e50b69
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:22.23.4-2.module+el9.8.0+25286+62e50b69
1:22.23.4-2.module+el9.8.0+25286+62e50b69
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:22.23.4-2.module+el9.8.0+25286+62e50b69
1:22.23.4-2.module+el9.8.0+25286+62e50b69
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:22.23.4-2.module+el9.8.0+25286+62e50b69
1:22.23.4-2.module+el9.8.0+25286+62e50b69
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:22.23.4-2.module+el9.8.0+25286+62e50b69
1:22.23.4-2.module+el9.8.0+25286+62e50b69
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:22.23.4-2.module+el9.8.0+25286+62e50b69
1:22.23.4-2.module+el9.8.0+25286+62e50b69
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 0:3.1.14-3.module+el9.8.0+25286+62e50b69
0:3.1.14-3.module+el9.8.0+25286+62e50b69
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 0:2021.06-6.module+el9.8.0+24709+804d6b5b
0:2021.06-6.module+el9.8.0+24709+804d6b5b
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 0:2021.06-6.module+el9.8.0+24709+804d6b5b
0:2021.06-6.module+el9.8.0+24709+804d6b5b
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 1:10.9.9-1.22.23.4.2.module+el9.8.0+25286+62e50b69
1:10.9.9-1.22.23.4.2.module+el9.8.0+25286+62e50b69
v8-12.4-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
before 3:12.4.254.21-1.22.23.4.2.module+el9.8.0+25286+62e50b69
3:12.4.254.21-1.22.23.4.2.module+el9.8.0+25286+62e50b69
nodejs-nodemon
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
before 0:3.1.14-5.el10_2
0:3.1.14-5.el10_2
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:24.22.1-2.module+el8.10.0+25293+7b33a103
1:24.22.1-2.module+el8.10.0+25293+7b33a103
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:24.22.1-2.module+el8.10.0+25293+7b33a103
1:24.22.1-2.module+el8.10.0+25293+7b33a103
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:24.22.1-2.module+el8.10.0+25293+7b33a103
1:24.22.1-2.module+el8.10.0+25293+7b33a103
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:24.22.1-2.module+el8.10.0+25293+7b33a103
1:24.22.1-2.module+el8.10.0+25293+7b33a103
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:24.22.1-2.module+el8.10.0+25293+7b33a103
1:24.22.1-2.module+el8.10.0+25293+7b33a103
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:24.22.1-2.module+el8.10.0+25293+7b33a103
1:24.22.1-2.module+el8.10.0+25293+7b33a103
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:24.22.1-2.module+el8.10.0+25293+7b33a103
1:24.22.1-2.module+el8.10.0+25293+7b33a103
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:24.22.1-2.module+el8.10.0+25293+7b33a103
1:24.22.1-2.module+el8.10.0+25293+7b33a103
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 0:3.1.14-2.module+el8.10.0+25293+7b33a103
0:3.1.14-2.module+el8.10.0+25293+7b33a103
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 0:2021.06-6.module+el8.10.0+24711+b610b202
0:2021.06-6.module+el8.10.0+24711+b610b202
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:11.19.1-1.24.22.1.2.module+el8.10.0+25293+7b33a103
1:11.19.1-1.24.22.1.2.module+el8.10.0+25293+7b33a103
v8-13.6-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 3:13.6.233.17-1.24.22.1.2.module+el8.10.0+25293+7b33a103
3:13.6.233.17-1.24.22.1.2.module+el8.10.0+25293+7b33a103
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:22.23.4-2.module+el8.10.0+25285+c731a801
1:22.23.4-2.module+el8.10.0+25285+c731a801
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:22.23.4-2.module+el8.10.0+25285+c731a801
1:22.23.4-2.module+el8.10.0+25285+c731a801
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:22.23.4-2.module+el8.10.0+25285+c731a801
1:22.23.4-2.module+el8.10.0+25285+c731a801
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:22.23.4-2.module+el8.10.0+25285+c731a801
1:22.23.4-2.module+el8.10.0+25285+c731a801
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:22.23.4-2.module+el8.10.0+25285+c731a801
1:22.23.4-2.module+el8.10.0+25285+c731a801
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:22.23.4-2.module+el8.10.0+25285+c731a801
1:22.23.4-2.module+el8.10.0+25285+c731a801
nodejs-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:22.23.4-2.module+el8.10.0+25285+c731a801
1:22.23.4-2.module+el8.10.0+25285+c731a801
nodejs-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:22.23.4-2.module+el8.10.0+25285+c731a801
1:22.23.4-2.module+el8.10.0+25285+c731a801
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 0:3.1.14-3.module+el8.10.0+25285+c731a801
0:3.1.14-3.module+el8.10.0+25285+c731a801
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 0:2021.06-6.module+el8.10.0+24710+c2e9b41f
0:2021.06-6.module+el8.10.0+24710+c2e9b41f
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 0:2021.06-6.module+el8.10.0+24710+c2e9b41f
0:2021.06-6.module+el8.10.0+24710+c2e9b41f
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 1:10.9.9-1.22.23.4.2.module+el8.10.0+25285+c731a801
1:10.9.9-1.22.23.4.2.module+el8.10.0+25285+c731a801
v8-12.4-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
before 3:12.4.254.21-1.22.23.4.2.module+el8.10.0+25285+c731a801
3:12.4.254.21-1.22.23.4.2.module+el8.10.0+25285+c731a801
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:26.12.1-2.module+el9.9.0+25297+fc0af076
1:26.12.1-2.module+el9.9.0+25297+fc0af076
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:26.12.1-2.module+el9.9.0+25297+fc0af076
1:26.12.1-2.module+el9.9.0+25297+fc0af076
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:26.12.1-2.module+el9.9.0+25297+fc0af076
1:26.12.1-2.module+el9.9.0+25297+fc0af076
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:26.12.1-2.module+el9.9.0+25297+fc0af076
1:26.12.1-2.module+el9.9.0+25297+fc0af076
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:26.12.1-2.module+el9.9.0+25297+fc0af076
1:26.12.1-2.module+el9.9.0+25297+fc0af076
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:26.12.1-2.module+el9.9.0+25297+fc0af076
1:26.12.1-2.module+el9.9.0+25297+fc0af076
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:26.12.1-2.module+el9.9.0+25297+fc0af076
1:26.12.1-2.module+el9.9.0+25297+fc0af076
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:26.12.1-2.module+el9.9.0+25297+fc0af076
1:26.12.1-2.module+el9.9.0+25297+fc0af076
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 0:3.1.14-2.module+el9.9.0+25283+460aabd3
0:3.1.14-2.module+el9.9.0+25283+460aabd3
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 0:2021.06-6.module+el9.9.0+24923+ac50c00f
0:2021.06-6.module+el9.9.0+24923+ac50c00f
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 0:2021.06-6.module+el9.9.0+24923+ac50c00f
0:2021.06-6.module+el9.9.0+24923+ac50c00f
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 1:11.20.0-1.26.12.1.2.module+el9.9.0+25297+fc0af076
1:11.20.0-1.26.12.1.2.module+el9.9.0+25297+fc0af076
v8-14.6-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
before 3:14.6.202.34-1.26.12.1.2.module+el9.9.0+25297+fc0af076
3:14.6.202.34-1.26.12.1.2.module+el9.9.0+25297+fc0af076
cockpit-image-builder
Red Hat:enterprise_linux:10.3
From an advisory covering 4 CVEs
before 0:110.3-1.el10_3
0:110.3-1.el10_3
nodejs26
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:26.12.1-3.el10_3
1:26.12.1-3.el10_3
nodejs26-debuginfo
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:26.12.1-3.el10_3
1:26.12.1-3.el10_3
nodejs26-debugsource
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:26.12.1-3.el10_3
1:26.12.1-3.el10_3
nodejs26-devel
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:26.12.1-3.el10_3
1:26.12.1-3.el10_3
nodejs26-docs
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:26.12.1-3.el10_3
1:26.12.1-3.el10_3
nodejs26-full-i18n
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:26.12.1-3.el10_3
1:26.12.1-3.el10_3
nodejs26-libs
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:26.12.1-3.el10_3
1:26.12.1-3.el10_3
nodejs26-libs-debuginfo
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:26.12.1-3.el10_3
1:26.12.1-3.el10_3
nodejs26-npm
Red Hat:enterprise_linux:10.3
From an advisory covering 31 CVEs
before 1:11.20.0-1.26.12.1.3.el10_3
1:11.20.0-1.26.12.1.3.el10_3
cockpit-image-builder
Red Hat:enterprise_linux_eus:10.2
From an advisory covering 2 CVEs
before 0:94.5-1.el10_2
0:94.5-1.el10_2
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 13 CVEs
before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs
Rocky Linux:9
From an advisory covering 13 CVEs
before 1:24.22.1-3.module+el9.8.0+40401+e24b8c95
1:24.22.1-3.module+el9.8.0+40401+e24b8c95
nodejs-nodemon
Rocky Linux:9
From an advisory covering 13 CVEs
before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 13 CVEs
before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs24
Rocky Linux:10
From an advisory covering 9 CVEs
before 1:24.22.1-3.el10_2
1:24.22.1-3.el10_2
nodejs22
Rocky Linux:10
From an advisory covering 8 CVEs
before 1:22.23.4-1.el10_2
1:22.23.4-1.el10_2
nodejs-packaging
Rocky Linux:9
From an advisory covering 10 CVEs
before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 10 CVEs
before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 10 CVEs
before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 10 CVEs
before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-nodemon
Rocky Linux:9
From an advisory covering 7 CVEs
before 0:3.1.14-3.module+el9.8.0+40281+14cc6568
0:3.1.14-3.module+el9.8.0+40281+14cc6568
nodejs-packaging
Rocky Linux:9
From an advisory covering 7 CVEs
before 0:2021.06-6.module+el9.7.0+40165+d075e3f2
0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Rocky Linux:9
From an advisory covering 7 CVEs
before 0:2021.06-6.module+el9.7.0+40052+e32ea525
0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Rocky Linux:9
From an advisory covering 7 CVEs
before 0:2021.06-6.module+el9.7.0+40153+4d595597
0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Rocky Linux:9
From an advisory covering 7 CVEs
before 0:2021.06-6.module+el9.8.0+40164+8921ab53
0:2021.06-6.module+el9.8.0+40164+8921ab53
nodejs-nodemon
Rocky Linux:10
From an advisory covering 2 CVEs
before 0:3.1.14-5.el10_2
0:3.1.14-5.el10_2
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
before 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
nodejs-nodemon
Rocky Linux:8
From an advisory covering 8 CVEs
before 0:3.1.14-2.module+el8.10.0+40278+50b003a3
0:3.1.14-2.module+el8.10.0+40278+50b003a3
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
before 0:2021.06-6.module+el8.10.0+40048+6d99f608
0:2021.06-6.module+el8.10.0+40048+6d99f608
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
before 0:2021.06-6.module+el8.10.0+40171+8fa9c325
0:2021.06-6.module+el8.10.0+40171+8fa9c325
nodejs-packaging
Rocky Linux:8
From an advisory covering 8 CVEs
before 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
0:2021.06-6.module+el8.10.0+40172+38f6fdd1
nodejs-nodemon
Rocky Linux:9
From an advisory covering 10 CVEs
before 0:3.1.14-2.module+el9.8.0+40264+d9b257bb
0:3.1.14-2.module+el9.8.0+40264+d9b257bb
nodejs-nodemon
Rocky Linux:9
From an advisory covering 10 CVEs
before 0:3.1.14-2.module+el9.8.0+40280+057606e8
0:3.1.14-2.module+el9.8.0+40280+057606e8
cockpit-image-builder
Rocky Linux:10
From an advisory covering 4 CVEs
before 0:110.3-1.el10_3
0:110.3-1.el10_3
node-brace-expansion
Ubuntu:18.04:LTS
All versions, plus listed versions
1.1.8-1
None known
node-brace-expansion
Ubuntu:20.04:LTS
All versions, plus listed versions
1.1.8-11.1.11-1
None known
node-brace-expansion
Ubuntu:22.04:LTS
All versions, plus listed versions
2.0.0-12.0.1-1
None known
node-brace-expansion
Ubuntu:24.04:LTS
All versions, plus listed versions
2.0.1-22.0.1+~1.1.0-1
None known
node-brace-expansion
Ubuntu:26.10
All versions, plus listed versions
2.0.1+~1.1.0-22.0.3+~1.1.2-22.0.3+~1.1.2-32.1.4+~1.1.2-1
None known
node-brace-expansion
Ubuntu:26.04:LTS
All versions, plus listed versions
2.0.1+~1.1.0-2
None known
pi-coding-agent
openSUSE:Tumbleweed
before 1.0.2-1.1
1.0.2-1.1
pi-coding-agent
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
before 1.0.4-bp160.1.1
1.0.4-bp160.1.1

What each source reports

CVE List Score used7.5

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
EUVDEUVD-2026-885507.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
EUVD-2026-88550
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6j4f-fj2g-mc7p7.5

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary

parseCommaParts() can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string.

This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made expand_() iterative and documented a constant-stack-depth guarantee, but parseCommaParts() was left recursive, so the guarantee only held for one of the two parsing paths.

Vector 1 - unbounded recursion on post

parseCommaParts() recursed on the remainder of the string once per brace group:

const postParts = parseCommaParts(post)   // unbounded

A brace group containing many comma-separated groups drives one recursion level per group:

expand('{' + '{a},'.repeat(7000) + 'b}')
// RangeError: Maximum call stack size exceeded

About 7,300 repetitions - roughly 29 KB of input - is enough on Node 24; roughly 6,300 (25 KB) on Node 18. The threshold is identical on every affected release line.

Vector 2 - push.apply with an unbounded array

Even with the recursion removed, parseCommaParts() spread whole arrays into an argument list:

p.push.apply(p, postParts)
parts.push.apply(parts, p)

Function.prototype.apply places one argument per element on the stack, so a single large array overflows it. This needs no recursion depth at all - the following reaches a recursion depth of exactly 1:

expand('{{x},' + 'a,'.repeat(125000) + 'b}')
// RangeError: Maximum call stack size exceeded

Threshold is about 124,300 repetitions (~249 KB). This vector was not part of the original report; it was found while verifying the fix. A patch that only de-recurses but keeps push.apply leaves a working denial of service behind.

Why max and maxLength do not help

Both crashes happen during parsing, before any expansion. The payloads produce one result per group, so output size grows linearly with input and is never the limiter. expand(payload, { max: 1, maxLength: 1 }) still overflows.

Impact

Any application that passes an untrusted string to expand() - directly, or through minimatch / glob where it is a user-supplied glob pattern - can be crashed. In Node, a RangeError that the application does not catch terminates the process, so a server that globs user input is exposed to remote unauthenticated denial of service.

minimatch's own MAX_PATTERN_LENGTH cap (65,536) does not help against vector 1: the overflow threshold sits well below it. Confirmed on minimatch 10.2.6 - a 64,003-byte pattern passes the length check and overflows both minimatch.braceExpand() and new minimatch.Minimatch().

This is an availability-only issue. No code execution and no data exposure.

Not a regression

5.0.8 and 5.0.9 overflow at the same repetition count, so the gap predates the recent advisories; those fixes simply did not reach it. Verified affected on 1.1.18, 2.1.4, 3.0.6, 5.0.8 and 5.0.9, all at an identical threshold.

Patch

parseCommaParts() is rewritten as a loop that carries the partial part across chunks, and every array append uses an element-by-element loop rather than push.apply. The redundant if (!str) return [''] guard is dropped - the loop returns [''] for the empty string on its own.

Equivalence of the old and new implementations was checked by differential testing: exhaustive over every string of {, }, ,, a up to length 7 plus 300,000 random inputs - 322,000 cases, zero mismatches.

Severity note

Scored 7.5 High under CVSS 3.1 for consistency with the other availability advisories on this package (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), which use the same vector. The reporter self-assessed 6.9 Medium under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

Credit

Reported by baeseungwon1010, with a working proof of concept and a proposed patch. Vector 2 was identified during maintainer verification.

Record
GHSA-6j4f-fj2g-mc7p
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
NVD7.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
OSV7.5

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-10
OSVDEBIAN-CVE-2026-1022767.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
DEBIAN-CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSVGHSA-6j4f-fj2g-mc7p7.5

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary

parseCommaParts() can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string.

This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made expand_() iterative and documented a constant-stack-depth guarantee, but parseCommaParts() was left recursive, so the guarantee only held for one of the two parsing paths.

Vector 1 - unbounded recursion on post

parseCommaParts() recursed on the remainder of the string once per brace group:

const postParts = parseCommaParts(post)   // unbounded

A brace group containing many comma-separated groups drives one recursion level per group:

expand('{' + '{a},'.repeat(7000) + 'b}')
// RangeError: Maximum call stack size exceeded

About 7,300 repetitions - roughly 29 KB of input - is enough on Node 24; roughly 6,300 (25 KB) on Node 18. The threshold is identical on every affected release line.

Vector 2 - push.apply with an unbounded array

Even with the recursion removed, parseCommaParts() spread whole arrays into an argument list:

p.push.apply(p, postParts)
parts.push.apply(parts, p)

Function.prototype.apply places one argument per element on the stack, so a single large array overflows it. This needs no recursion depth at all - the following reaches a recursion depth of exactly 1:

expand('{{x},' + 'a,'.repeat(125000) + 'b}')
// RangeError: Maximum call stack size exceeded

Threshold is about 124,300 repetitions (~249 KB). This vector was not part of the original report; it was found while verifying the fix. A patch that only de-recurses but keeps push.apply leaves a working denial of service behind.

Why max and maxLength do not help

Both crashes happen during parsing, before any expansion. The payloads produce one result per group, so output size grows linearly with input and is never the limiter. expand(payload, { max: 1, maxLength: 1 }) still overflows.

Impact

Any application that passes an untrusted string to expand() - directly, or through minimatch / glob where it is a user-supplied glob pattern - can be crashed. In Node, a RangeError that the application does not catch terminates the process, so a server that globs user input is exposed to remote unauthenticated denial of service.

minimatch's own MAX_PATTERN_LENGTH cap (65,536) does not help against vector 1: the overflow threshold sits well below it. Confirmed on minimatch 10.2.6 - a 64,003-byte pattern passes the length check and overflows both minimatch.braceExpand() and new minimatch.Minimatch().

This is an availability-only issue. No code execution and no data exposure.

Not a regression

5.0.8 and 5.0.9 overflow at the same repetition count, so the gap predates the recent advisories; those fixes simply did not reach it. Verified affected on 1.1.18, 2.1.4, 3.0.6, 5.0.8 and 5.0.9, all at an identical threshold.

Patch

parseCommaParts() is rewritten as a loop that carries the partial part across chunks, and every array append uses an element-by-element loop rather than push.apply. The redundant if (!str) return [''] guard is dropped - the loop returns [''] for the empty string on its own.

Equivalence of the old and new implementations was checked by differential testing: exhaustive over every string of {, }, ,, a up to length 7 plus 300,000 random inputs - 322,000 cases, zero mismatches.

Severity note

Scored 7.5 High under CVSS 3.1 for consistency with the other availability advisories on this package (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), which use the same vector. The reporter self-assessed 6.9 Medium under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

Credit

Reported by baeseungwon1010, with a working proof of concept and a proposed patch. Vector 2 was identified during maintainer verification.

Record
GHSA-6j4f-fj2g-mc7p
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-674
Updated
2026-11-02
OSVRHSA-2026:741617.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:74161
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:741677.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:74167
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:741687.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:74168
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:846577.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:84657
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:923768.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:92376
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:923788.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Record
RHSA-2026:92378
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:960887.5

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Record
RHSA-2026:96088
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:960947.5

Red Hat Security Advisory: nodejs22 security update

Record
RHSA-2026:96094
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:962267.8

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:96226
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:962347.5

Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Record
RHSA-2026:96234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:962367.5

Red Hat Security Advisory: nodejs-nodemon security update

Record
RHSA-2026:96236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:981027.8

Red Hat Security Advisory: nodejs:24 security update

Record
RHSA-2026:98102
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:981137.5

Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

Record
RHSA-2026:98113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:985228.1

Red Hat Security Advisory: nodejs:26 security, bug fix, and enhancement update

Record
RHSA-2026:98522
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVRHSA-2026:986137.5

Red Hat Security Advisory: cockpit-image-builder security update

Record
RHSA-2026:98613
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:986197.7

Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update

Record
RHSA-2026:98619
CVSS 3.0
7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-13
OSVRHSA-2026:991157.5

Red Hat Security Advisory: cockpit-image-builder security update

Record
RHSA-2026:99115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRLSA-2026:923768.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92376
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:923788.1

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92378
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:960887.5

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

  • undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-295759)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:96088
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-10
OSVRLSA-2026:960947.5

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

  • undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:96094
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-10
OSVRLSA-2026:962267.8

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

  • minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)

  • sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)

  • sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)

  • sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:96226
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-10
OSVRLSA-2026:962347.5

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-302833)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:96234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-10
OSVRLSA-2026:962367.5

Important: nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:96236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-10
OSVRLSA-2026:981027.8

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

  • sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)

  • sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)

  • sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:98102
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-11
OSVRLSA-2026:981137.5

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

  • undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:Rocky Linux-289618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:98113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-11
OSVRLSA-2026:985228.1

Important: nodejs:26 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

  • undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)

  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

  • nodejs:26/nodejs: Rebase to the latest Node.js 26 release [rhel-9.9] (JIRA:Rocky Linux-289767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:98522
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-12
OSVRLSA-2026:986137.5

Critical: cockpit-image-builder security update

The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.

Security Fix(es):

  • source-map-js: source-map-js: Denial of Service via malformed indexed source maps (CVE-2026-93749)

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

  • zod: zod: Denial of service via unbounded array validation (CVE-2023-54404)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:98613
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVUBUNTU-CVE-2026-1022767.5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
UBUNTU-CVE-2026-102276
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:92376No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92376
Updated
2026-11-02
OSVALSA-2026:92378No score

Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
  • nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
  • nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
  • nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
  • nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
  • nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

  • nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92378
Updated
2026-11-02
OSVALSA-2026:96088No score

Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
  • undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)
  • nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

  • nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:96088
Updated
2026-11-10
OSVALSA-2026:96094No score

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
  • undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:96094
Updated
2026-11-10
OSVALSA-2026:96234No score

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:RHEL-302833)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:96234
Updated
2026-11-10
OSVALSA-2026:96236No score

Important: nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:96236
Updated
2026-11-10
OSVALSA-2026:98102No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
  • sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)
  • sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)
  • sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:98102
Updated
2026-11-13
OSVALSA-2026:98113No score

Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
  • brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
  • undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
  • undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
  • undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
  • undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)
  • nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
  • nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

  • nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:RHEL-289618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:98113
Updated
2026-11-13
OSVAZL-105075No score

CVE-2026-102276 affecting package js-jquery 3.5.0-4

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
AZL-105075
Updated
2026-11-05
OSVAZL-105096No score

CVE-2026-102276 affecting package nodejs-nodemon 2.0.3-5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
AZL-105096
Updated
2026-11-05
OSVAZL-105248No score

CVE-2026-102276 affecting package python-tensorboard 2.16.2-6

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Record
AZL-105248
Updated
2026-11-02
OSVCLSA-2026-1790807349No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 4.0.1-tuxcare.1.

Record
CLSA-2026-1790807349
Updated
2026-11-02
OSVCLSA-2026-1790807354No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.2-tuxcare.1.

Record
CLSA-2026-1790807354
Updated
2026-11-02
OSVCLSA-2026-1790807467No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.1.

Record
CLSA-2026-1790807467
Updated
2026-11-02
OSVCLSA-2026-1790856945No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.1.

Record
CLSA-2026-1790856945
Updated
2026-11-02
OSVCLSA-2026-1790863041No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.15-tuxcare.1.

Record
CLSA-2026-1790863041
Updated
2026-11-02
OSVCLSA-2026-1790864778No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.14-tuxcare.1.

Record
CLSA-2026-1790864778
Updated
2026-11-02
OSVCLSA-2026-1790887113No score

TuxCare security update for brace-expansion (3 CVEs)

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.4.

Record
CLSA-2026-1790887113
Updated
2026-11-02

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 167 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 16 source records.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open