{
"vulnerabilities": [
{
"id": "SNYK-UBUNTU2204-LUA51-16055377",
"cpes": [],
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P",
"credit": [
""
],
"semver": {
"vulnerable": [
"<5.1.5-8.1ubuntu0.22.04.1~esm1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"5.1.5-8.1ubuntu0.22.04.1~esm1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 9.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844"
},
{
"url": "https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539",
"title": "https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539"
},
{
"url": "https://github.com/redis/redis/releases/tag/8.2.2",
"title": "https://github.com/redis/redis/releases/tag/8.2.2"
},
{
"url": "https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q",
"title": "https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/10/07/2",
"title": "http://www.openwall.com/lists/oss-security/2025/10/07/2"
},
{
"url": "https://github.com/lastvocher/redis-CVE-2025-49844",
"title": "https://github.com/lastvocher/redis-CVE-2025-49844"
},
{
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml",
"title": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cvssV3BaseScore": 9.9,
"modificationTime": "2025-10-08T01:13:35.627789Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2025-10-06T21:51:55.693804Z"
},
{
"assigner": "SUSE",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"cvssV3BaseScore": 9.9,
"modificationTime": "2025-10-09T11:02:48.267745Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.9,
"cvssVersion": "3.1",
"modificationTime": "2025-10-08T01:13:35.627789Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2025-10-06T21:51:55.693804Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "critical",
"baseScore": 9.9,
"cvssVersion": "3.1",
"modificationTime": "2025-10-09T11:02:48.267745Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `lua5.1` package and not the `lua5.1` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nRedis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.\n## Remediation\nUpgrade `Ubuntu:22.04` `lua5.1` to version 5.1.5-8.1ubuntu0.22.04.1~esm1 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844)\n- [https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539](https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539)\n- [https://github.com/redis/redis/releases/tag/8.2.2](https://github.com/redis/redis/releases/tag/8.2.2)\n- [https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q](https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q)\n- [http://www.openwall.com/lists/oss-security/2025/10/07/2](http://www.openwall.com/lists/oss-security/2025/10/07/2)\n- [https://github.com/lastvocher/redis-CVE-2025-49844](https://github.com/lastvocher/redis-CVE-2025-49844)\n- [https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml](https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml)\n",
"epssDetails": {
"percentile": "0.99636",
"probability": "0.82294",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-49844"
],
"CWE": [
"CWE-416"
],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "lua5.1",
"creationTime": "2026-04-15T03:23:11.908597Z",
"disclosureTime": "2025-10-03T20:15:32.823000Z",
"exploitDetails": {
"sources": [
"Nuclei Templates",
"PoC in GitHub"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-04-15T03:23:11.913504Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-09-23T14:54:52.907776Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/scope-cms@3.46.1_bc479f0.1531",
"redis@5:6.0.16-1ubuntu1.1",
"redis/redis-server@5:6.0.16-1ubuntu1.1",
"redis/redis-tools@5:6.0.16-1ubuntu1.1",
"lua5.1/liblua5.1-0@5.1.5-8.1build4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "lua5.1/liblua5.1-0",
"version": "5.1.5-8.1build4",
"nearestFixedInVersion": "5.1.5-8.1ubuntu0.22.04.1~esm1"
},
{
"id": "SNYK-UBUNTU2204-LUABITOP-16055370",
"cpes": [],
"title": "Stack-based Buffer Overflow",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<1.0.2-5ubuntu0.22.04.1~esm2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.0.2-5ubuntu0.22.04.1~esm2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 8.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449"
},
{
"url": "https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9",
"title": "https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9"
},
{
"url": "https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5",
"title": "https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2025-09-05T01:13:20.390177Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2024-10-09T13:46:25.968279Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2024-10-08T11:01:53.868866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2025-09-05T01:13:20.390177Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2024-10-09T13:46:25.968279Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2024-10-08T11:01:53.868866Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `lua-bitop` package and not the `lua-bitop` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nRedis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n## Remediation\nUpgrade `Ubuntu:22.04` `lua-bitop` to version 1.0.2-5ubuntu0.22.04.1~esm2 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449)\n- [https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9](https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9)\n- [https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5](https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5)\n",
"epssDetails": {
"percentile": "0.90389",
"probability": "0.04495",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-31449"
],
"CWE": [
"CWE-121",
"CWE-20"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "lua-bitop",
"creationTime": "2026-04-15T03:23:03.937336Z",
"disclosureTime": "2024-10-07T20:15:05.507000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-04-15T03:23:03.941651Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-09-23T14:53:37.677028Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/scope-cms@3.46.1_bc479f0.1531",
"redis@5:6.0.16-1ubuntu1.1",
"redis/redis-server@5:6.0.16-1ubuntu1.1",
"redis/redis-tools@5:6.0.16-1ubuntu1.1",
"lua-bitop@1.0.2-5"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "lua-bitop",
"version": "1.0.2-5",
"nearestFixedInVersion": "1.0.2-5ubuntu0.22.04.1~esm2"
},
{
"id": "SNYK-UPSTREAM-NODE-15763402",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"mbarbs"
],
"semver": {
"vulnerable": [
"[,20.20.2)",
"[21.0.0,22.22.2)",
"[23.0.0,24.14.1)",
"[25.0.0,25.8.2)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"20.20.2",
"22.22.2",
"24.14.1",
"25.8.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/85f73e7057e9badf6e7713f7440769375cdb5df5",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
"title": "Node.js Security Releases"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-03-25T15:07:16.499813Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-03-25T15:07:16.499813Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Uncaught Exception in the TLS module when a `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.\r\n\r\n**Note:**\r\n\r\nThis is caused by an incomplete fix for [CVE-2026-21637](https://security.snyk.io/vuln/SNYK-UNMANAGED-NODEJSNODE-14982194).\n## Remediation\nUpgrade `node` to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/85f73e7057e9badf6e7713f7440769375cdb5df5)\n- [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-248"
]
},
"packageName": "node",
"creationTime": "2026-03-25T15:07:16.175367Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T15:03:05Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-03-25T15:07:16.478418Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-03-25T15:07:16.499813Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.22.2"
},
{
"id": "SNYK-UPSTREAM-NODE-15763406",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"yushengchen"
],
"semver": {
"vulnerable": [
"[,20.20.2)",
"[21.0.0,22.22.2)",
"[23.0.0,24.14.1)",
"[25.0.0,25.8.2)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"20.20.2",
"22.22.2",
"24.14.1",
"25.8.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/00ad47a28e",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
"title": "Node.js Security Releases"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-04T12:22:11.002541Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-15T11:52:27.579789Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-20T14:04:39.620337Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-20T14:04:39.620337Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-04T12:22:11.002541Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-15T11:52:27.579789Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named `__proto__` and the server application accesses `req.headersDistinct`. This causes `dest[\"__proto__\"]` to incorrectly resolve to `Object.prototype`, resulting in an uncaught TypeError when `.push()` is called on a non-array. Because this exception is thrown synchronously inside a property getter, standard error listeners cannot intercept it. This causes the Node.js process to crash unless every access is explicitly wrapped in a try/catch block.\n## Remediation\nUpgrade `node` to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/00ad47a28e)\n- [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.97749",
"probability": "0.25044",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-21710"
],
"CWE": [
"CWE-248"
]
},
"packageName": "node",
"creationTime": "2026-03-25T15:20:50.610078Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T15:18:26Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-03-25T15:20:50.872353Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-20T14:04:39.620337Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.22.2"
},
{
"id": "SNYK-UPSTREAM-NODE-17674807",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"erichen"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.0)",
"[23.0.0, 24.17.0)",
"[25.0.0, 26.3.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.0",
"24.17.0",
"26.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
"title": "Node.js Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-27T06:47:40.179091Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-26T11:01:41.429545Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-03T15:25:46.854522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-03T15:25:46.854522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-27T06:47:40.179091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.429545Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the WebCrypto cipher output length calculation in `src/crypto/crypto_aes.cc`, where `data_len + blockSize + tag_len` is computed as a signed `int` before being passed to OpenSSL. An attacker can abort the process and cause a denial of service by passing an input around a multiple of 2 GiB to `subtle.encrypt()`, which overflows that length computation and crashes the runtime.\n## Remediation\nUpgrade `node` to version 22.23.0, 24.17.0, 26.3.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff)\n- [Node.js Advisory](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.88594",
"probability": "0.03711",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48933"
],
"CWE": [
"CWE-190"
]
},
"packageName": "node",
"creationTime": "2026-06-29T14:31:58.946820Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T02:08:32.113000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-06-29T14:31:59.135778Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-03T15:25:46.854522Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.23.0"
},
{
"id": "SNYK-UPSTREAM-NODE-18507942",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"credit": [
"vnyuh"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 6.3,
"modificationTime": "2026-08-05T06:03:44.647596Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 6.3,
"modificationTime": "2026-08-07T11:01:48.504262Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-19T14:06:11.511473Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T14:06:11.511473Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:03:44.647596Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:48.504262Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Improper Certificate Validation due to the `HTTPS Agent` skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname validation.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62)\n- [GitHub Commit](https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c)\n- [GitHub Commit](https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.20453",
"probability": "0.00278",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58040"
],
"CWE": [
"CWE-295"
]
},
"packageName": "node",
"creationTime": "2026-08-02T12:15:22.422438Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-30T15:48:41Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-02T12:15:22.587494Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-19T14:06:11.511473Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18507943",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"credit": [
"sinan-polat"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.4,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.4,
"modificationTime": "2026-08-05T05:50:30.795493Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.3,
"modificationTime": "2026-08-07T11:01:49.032075Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.4,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:05:41.076573Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:05:41.076573Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:50:30.795493Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:49.032075Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the `process.report`. An attacker can access or overwrite files outside of the intended `--allow-fs-write` paths by leveraging this flaw to bypass security boundaries.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099)\n- [GitHub Commit](https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.04546",
"probability": "0.00152",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58039"
],
"CWE": [
"CWE-22"
]
},
"packageName": "node",
"creationTime": "2026-08-02T12:15:46.875620Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-31T01:48:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-02T12:15:47.051773Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:05:41.076573Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18553644",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"leduckhuong"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/f14d78b9e0",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T05:49:05.944858Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T11:01:47.905351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:07:28.769480Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:07:28.769480Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T05:49:05.944858Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:47.905351Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756)\n- [GitHub Commit](https://github.com/nodejs/node/commit/f14d78b9e0)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.40505",
"probability": "0.00500",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56846"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:00:32.348238Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:55:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:00:46.764993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:07:28.769480Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18553648",
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hahahkim"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/23b94c843a",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-08T05:30:23.932871Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T11:01:48.414364Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:07:28.701007Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:07:28.701007Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T05:30:23.932871Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:48.414364Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when `nghttp2_session_mem_send()` is called re-entrantly during the execution of `nghttp2_session_mem_recv()`. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant calls, potentially leading to denial of service or other unpredictable behavior.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/23b94c843a)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.39905",
"probability": "0.00490",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56848"
],
"CWE": [
"CWE-416"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:01:23.611072Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T18:13:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:01:45.203590Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:07:28.701007Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18553653",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"cantina-security"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/22efc051a3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-11T05:30:10.378598Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-07T11:01:49.572976Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:05:40.208057Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:05:40.208057Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T05:30:10.378598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:49.572976Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `dns.resolveAny` function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DNS responses.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/22efc051a3)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a)\n- [GitHub Commit](https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.29630",
"probability": "0.00369",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58042"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:04:10.503438Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:54:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:04:21.066266Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:05:40.208057Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18553660",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"byvini"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/b3fbb6e11f",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.2,
"modificationTime": "2026-08-11T05:30:55.443628Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.2,
"modificationTime": "2026-08-07T11:01:50.421860Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:05:40.635568Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:05:40.635568Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.2,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T05:30:55.443628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.2,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:50.421860Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `node:zlib` synchronous APIs when a spoofed `TypedArray` `byteLength` triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this condition.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098)\n- [GitHub Commit](https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343)\n- [GitHub Commit](https://github.com/nodejs/node/commit/b3fbb6e11f)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.05983",
"probability": "0.00166",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58045"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:04:53.622382Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:55:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:05:01.741048Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:05:40.635568Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.0",
"nearestFixedInVersion": "22.23.2"
}
],
"ok": false,
"dependencyCount": 757,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "deb",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {
"binariesVulns": {
"issuesData": {
"SNYK-UPSTREAM-NODE-15763402": {
"id": "SNYK-UPSTREAM-NODE-15763402",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"mbarbs"
],
"semver": {
"vulnerable": [
"[,20.20.2)",
"[21.0.0,22.22.2)",
"[23.0.0,24.14.1)",
"[25.0.0,25.8.2)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"20.20.2",
"22.22.2",
"24.14.1",
"25.8.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/85f73e7057e9badf6e7713f7440769375cdb5df5",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
"title": "Node.js Security Releases"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-03-25T15:07:16.499813Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-03-25T15:07:16.499813Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Uncaught Exception in the TLS module when a `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.\r\n\r\n**Note:**\r\n\r\nThis is caused by an incomplete fix for [CVE-2026-21637](https://security.snyk.io/vuln/SNYK-UNMANAGED-NODEJSNODE-14982194).\n## Remediation\nUpgrade `node` to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/85f73e7057e9badf6e7713f7440769375cdb5df5)\n- [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-248"
]
},
"packageName": "node",
"creationTime": "2026-03-25T15:07:16.175367Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T15:03:05Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-03-25T15:07:16.478418Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-03-25T15:07:16.499813Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-15763406": {
"id": "SNYK-UPSTREAM-NODE-15763406",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"yushengchen"
],
"semver": {
"vulnerable": [
"[,20.20.2)",
"[21.0.0,22.22.2)",
"[23.0.0,24.14.1)",
"[25.0.0,25.8.2)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"20.20.2",
"22.22.2",
"24.14.1",
"25.8.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/00ad47a28e",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",
"title": "Node.js Security Releases"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-04T12:22:11.002541Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-15T11:52:27.579789Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-20T14:04:39.620337Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-20T14:04:39.620337Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-04T12:22:11.002541Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-15T11:52:27.579789Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named `__proto__` and the server application accesses `req.headersDistinct`. This causes `dest[\"__proto__\"]` to incorrectly resolve to `Object.prototype`, resulting in an uncaught TypeError when `.push()` is called on a non-array. Because this exception is thrown synchronously inside a property getter, standard error listeners cannot intercept it. This causes the Node.js process to crash unless every access is explicitly wrapped in a try/catch block.\n## Remediation\nUpgrade `node` to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/00ad47a28e)\n- [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.97749",
"probability": "0.25044",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-21710"
],
"CWE": [
"CWE-248"
]
},
"packageName": "node",
"creationTime": "2026-03-25T15:20:50.610078Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T15:18:26Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-03-25T15:20:50.872353Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-20T14:04:39.620337Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-17674807": {
"id": "SNYK-UPSTREAM-NODE-17674807",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"erichen"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.0)",
"[23.0.0, 24.17.0)",
"[25.0.0, 26.3.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.0",
"24.17.0",
"26.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
"title": "Node.js Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-27T06:47:40.179091Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-26T11:01:41.429545Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-03T15:25:46.854522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-03T15:25:46.854522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-27T06:47:40.179091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.429545Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the WebCrypto cipher output length calculation in `src/crypto/crypto_aes.cc`, where `data_len + blockSize + tag_len` is computed as a signed `int` before being passed to OpenSSL. An attacker can abort the process and cause a denial of service by passing an input around a multiple of 2 GiB to `subtle.encrypt()`, which overflows that length computation and crashes the runtime.\n## Remediation\nUpgrade `node` to version 22.23.0, 24.17.0, 26.3.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff)\n- [Node.js Advisory](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.88594",
"probability": "0.03711",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48933"
],
"CWE": [
"CWE-190"
]
},
"packageName": "node",
"creationTime": "2026-06-29T14:31:58.946820Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T02:08:32.113000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-06-29T14:31:59.135778Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-03T15:25:46.854522Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18507942": {
"id": "SNYK-UPSTREAM-NODE-18507942",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"credit": [
"vnyuh"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 6.3,
"modificationTime": "2026-08-05T06:03:44.647596Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 6.3,
"modificationTime": "2026-08-07T11:01:48.504262Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-19T14:06:11.511473Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T14:06:11.511473Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:03:44.647596Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:48.504262Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Improper Certificate Validation due to the `HTTPS Agent` skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname validation.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62)\n- [GitHub Commit](https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c)\n- [GitHub Commit](https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.20453",
"probability": "0.00278",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58040"
],
"CWE": [
"CWE-295"
]
},
"packageName": "node",
"creationTime": "2026-08-02T12:15:22.422438Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-30T15:48:41Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-02T12:15:22.587494Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-19T14:06:11.511473Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18507943": {
"id": "SNYK-UPSTREAM-NODE-18507943",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"credit": [
"sinan-polat"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.4,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.4,
"modificationTime": "2026-08-05T05:50:30.795493Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.3,
"modificationTime": "2026-08-07T11:01:49.032075Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.4,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:05:41.076573Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:05:41.076573Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:50:30.795493Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:49.032075Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the `process.report`. An attacker can access or overwrite files outside of the intended `--allow-fs-write` paths by leveraging this flaw to bypass security boundaries.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099)\n- [GitHub Commit](https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.04546",
"probability": "0.00152",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58039"
],
"CWE": [
"CWE-22"
]
},
"packageName": "node",
"creationTime": "2026-08-02T12:15:46.875620Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-31T01:48:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-02T12:15:47.051773Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:05:41.076573Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18553644": {
"id": "SNYK-UPSTREAM-NODE-18553644",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"leduckhuong"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/f14d78b9e0",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T05:49:05.944858Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T11:01:47.905351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:07:28.769480Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:07:28.769480Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T05:49:05.944858Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:47.905351Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756)\n- [GitHub Commit](https://github.com/nodejs/node/commit/f14d78b9e0)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.40505",
"probability": "0.00500",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56846"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:00:32.348238Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:55:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:00:46.764993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:07:28.769480Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18553648": {
"id": "SNYK-UPSTREAM-NODE-18553648",
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hahahkim"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/23b94c843a",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-08T05:30:23.932871Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T11:01:48.414364Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:07:28.701007Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:07:28.701007Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T05:30:23.932871Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:48.414364Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when `nghttp2_session_mem_send()` is called re-entrantly during the execution of `nghttp2_session_mem_recv()`. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant calls, potentially leading to denial of service or other unpredictable behavior.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/23b94c843a)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.39905",
"probability": "0.00490",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56848"
],
"CWE": [
"CWE-416"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:01:23.611072Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T18:13:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:01:45.203590Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:07:28.701007Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18553653": {
"id": "SNYK-UPSTREAM-NODE-18553653",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"cantina-security"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/22efc051a3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-11T05:30:10.378598Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-07T11:01:49.572976Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:05:40.208057Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:05:40.208057Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T05:30:10.378598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:49.572976Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `dns.resolveAny` function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DNS responses.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/22efc051a3)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a)\n- [GitHub Commit](https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.29630",
"probability": "0.00369",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58042"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:04:10.503438Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:54:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:04:21.066266Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:05:40.208057Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18553660": {
"id": "SNYK-UPSTREAM-NODE-18553660",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"byvini"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/b3fbb6e11f",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.2,
"modificationTime": "2026-08-11T05:30:55.443628Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.2,
"modificationTime": "2026-08-07T11:01:50.421860Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:05:40.635568Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:05:40.635568Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.2,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T05:30:55.443628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.2,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:50.421860Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `node:zlib` synchronous APIs when a spoofed `TypedArray` `byteLength` triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this condition.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098)\n- [GitHub Commit](https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343)\n- [GitHub Commit](https://github.com/nodejs/node/commit/b3fbb6e11f)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.05983",
"probability": "0.00166",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58045"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:04:53.622382Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:55:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:05:01.741048Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:05:40.635568Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
}
},
"affectedPkgs": {
"node@22.22.0": {
"pkg": {
"name": "node",
"version": "22.22.0"
},
"issues": {
"SNYK-UPSTREAM-NODE-15763402": {
"issueId": "SNYK-UPSTREAM-NODE-15763402",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.22.2"
}
]
}
],
"nearestFixedInVersion": "22.22.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-15763406": {
"issueId": "SNYK-UPSTREAM-NODE-15763406",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.22.2"
}
]
}
],
"nearestFixedInVersion": "22.22.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-17674807": {
"issueId": "SNYK-UPSTREAM-NODE-17674807",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.23.0"
}
]
}
],
"nearestFixedInVersion": "22.23.0",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18507942": {
"issueId": "SNYK-UPSTREAM-NODE-18507942",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18507943": {
"issueId": "SNYK-UPSTREAM-NODE-18507943",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18553644": {
"issueId": "SNYK-UPSTREAM-NODE-18553644",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18553648": {
"issueId": "SNYK-UPSTREAM-NODE-18553648",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18553653": {
"issueId": "SNYK-UPSTREAM-NODE-18553653",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18553660": {
"issueId": "SNYK-UPSTREAM-NODE-18553660",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/scope-cms",
"version": "3.46.1_bc479f0.1531"
},
{
"name": "node",
"version": "22.22.0",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
}
}
}
}
},
"os": {
"prettyName": "Ubuntu 22.04.5 LTS"
}
},
"summary": "11 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 11,
"projectName": "docker-image|docker.io/scopear/scope-cms",
"platform": "linux/amd64",
"hasUnknownVersions": false,
"path": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531/scopear/scope-cms",
"applications": [
{
"vulnerabilities": [
{
"id": "SNYK-JS-JSYAML-17900054",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Mazze LeCzzare Frazer"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.0",
">=4.0.0 <4.3.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.0",
"4.3.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-14T13:31:36.106441Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-22T14:32:46.463730Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-22T14:32:46.463730Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-14T13:31:36.106441Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity in merge key (`<<`) handling during YAML parsing, where each mapping in a chain re-enumerates the keys inherited from the previous mapping. An attacker can exhaust CPU and cause denial of service by supplying a document with N chained merge mappings, which forces roughly O(N^2) work for O(N) input. Exploitation requires the application to parse untrusted YAML with the default or YAML11 schema, under which merge keys are resolved.\n## Remediation\nUpgrade `js-yaml` to version 3.15.0, 4.3.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4)\n",
"epssDetails": {
"percentile": "0.43469",
"probability": "0.00544",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59869"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-52cp-r559-cp3m"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-07-09T07:26:45.931900Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:47:08Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T07:26:46.274346Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-22T14:32:46.463730Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"shakapacker@9.7.0",
"js-yaml@4.1.0"
],
"upgradePath": [
false,
"js-yaml@4.3.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.1.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"shakapacker@9.7.0",
"js-yaml@4.1.0"
],
"upgradePath": [
false,
"js-yaml@4.3.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.1.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"shakapacker@9.7.0",
"js-yaml@4.1.0"
],
"upgradePath": [
false,
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.1.0"
}
],
"ok": false,
"dependencyCount": 27,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "yarn",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "3 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [],
"upgrade": {
"js-yaml@4.1.0": {
"upgradeTo": "js-yaml@4.3.2",
"upgrades": [
"js-yaml@4.1.0",
"js-yaml@4.1.0",
"js-yaml@4.1.0"
],
"vulns": [
"SNYK-JS-JSYAML-19496768",
"SNYK-JS-JSYAML-18593780",
"SNYK-JS-JSYAML-17900054"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 3,
"targetFile": "/usr/local/bundle/gems/shakapacker-9.7.0/package.json",
"projectName": "shakapacker",
"displayTargetFile": "/usr/local/bundle/gems/shakapacker-9.7.0/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531"
},
{
"vulnerabilities": [
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/core@7.29.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/core@7.29.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/core@7.29.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/core@7.29.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/plugin-proposal-object-rest-spread@7.20.7",
"@babel/helper-compilation-targets@7.27.2",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/plugin-proposal-object-rest-spread@7.20.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/plugin-proposal-object-rest-spread@7.20.7",
"@babel/helper-compilation-targets@7.27.2",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/plugin-proposal-object-rest-spread@7.20.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/preset-env@7.28.0",
"@babel/helper-compilation-targets@7.27.2",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/preset-env@7.28.0",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/preset-env@7.28.0",
"@babel/helper-compilation-targets@7.27.2",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/preset-env@7.28.0",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/plugin-transform-runtime@7.28.0",
"babel-plugin-polyfill-corejs3@0.13.0",
"core-js-compat@3.44.0",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/plugin-transform-runtime@7.28.0",
"babel-plugin-polyfill-corejs3@0.13.0",
"core-js-compat@3.50.0",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/plugin-transform-runtime@7.28.0",
"babel-plugin-polyfill-corejs3@0.13.0",
"core-js-compat@3.44.0",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/plugin-transform-runtime@7.28.0",
"babel-plugin-polyfill-corejs3@0.13.0",
"core-js-compat@3.50.0",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/preset-env@7.28.0",
"babel-plugin-polyfill-corejs3@0.13.0",
"core-js-compat@3.44.0",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/preset-env@7.28.0",
"babel-plugin-polyfill-corejs3@0.13.0",
"core-js-compat@3.50.0",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/preset-env@7.28.0",
"babel-plugin-polyfill-corejs3@0.13.0",
"core-js-compat@3.44.0",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/preset-env@7.28.0",
"babel-plugin-polyfill-corejs3@0.13.0",
"core-js-compat@3.50.0",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/plugin-transform-runtime@7.28.0",
"babel-plugin-polyfill-corejs2@0.4.14",
"@babel/helper-define-polyfill-provider@0.6.5",
"@babel/helper-compilation-targets@7.27.2",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/plugin-transform-runtime@7.28.0",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/plugin-transform-runtime@7.28.0",
"babel-plugin-polyfill-corejs2@0.4.14",
"@babel/helper-define-polyfill-provider@0.6.5",
"@babel/helper-compilation-targets@7.27.2",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/plugin-transform-runtime@7.28.0",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/preset-env@7.28.0",
"babel-plugin-polyfill-corejs2@0.4.14",
"@babel/helper-define-polyfill-provider@0.6.5",
"@babel/helper-compilation-targets@7.27.2",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/preset-env@7.28.0",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"@babel/preset-env@7.28.0",
"babel-plugin-polyfill-corejs2@0.4.14",
"@babel/helper-define-polyfill-provider@0.6.5",
"@babel/helper-compilation-targets@7.27.2",
"browserslist@4.25.1"
],
"upgradePath": [
false,
"@babel/preset-env@7.28.0",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.25.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"browserslist@4.28.1"
],
"upgradePath": [
false,
"webpack@5.104.1",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.1"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"browserslist@4.28.1"
],
"upgradePath": [
false,
"webpack@5.104.1",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.1"
},
{
"id": "SNYK-JS-DEEPMERGE-19964053",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
">=4.2.0"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "deepmerge",
"references": [
{
"url": "https://github.com/TehShrike/deepmerge/issues/273",
"title": "GitHub Issue"
},
{
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js%23L39-L60",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `deepmerge`.\n## References\n- [GitHub Issue](https://github.com/TehShrike/deepmerge/issues/273)\n- [Vulnerable Code](https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60)\n",
"epssDetails": {
"percentile": "0.29959",
"probability": "0.00361",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93753"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "deepmerge",
"proprietary": false,
"creationTime": "2026-09-20T11:33:32.488257Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47.949000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:33:32.661140Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-20T11:33:32.796356Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack-assets-manifest@6.5.0",
"deepmerge@4.3.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "deepmerge",
"version": "4.3.1"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"compression-webpack-plugin@12.0.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"compression-webpack-plugin@12.0.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"compression-webpack-plugin@12.0.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"compression-webpack-plugin@12.0.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"compression-webpack-plugin@12.0.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"compression-webpack-plugin@12.0.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"compression-webpack-plugin@12.0.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"compression-webpack-plugin@12.0.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"compression-webpack-plugin@12.0.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"compression-webpack-plugin@12.0.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"terser-webpack-plugin@5.4.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"terser-webpack-plugin@5.4.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"terser-webpack-plugin@5.4.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"terser-webpack-plugin@5.4.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"terser-webpack-plugin@5.4.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack-assets-manifest@6.5.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack-assets-manifest@6.5.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack-assets-manifest@6.5.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack-assets-manifest@6.5.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack-assets-manifest@6.5.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack-assets-manifest@6.5.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack-assets-manifest@6.5.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack-assets-manifest@6.5.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack-assets-manifest@6.5.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack-assets-manifest@6.5.0",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"shakapacker@9.7.0",
"js-yaml@4.3.1"
],
"upgradePath": [
false,
"shakapacker@9.7.0",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.1"
},
{
"id": "SNYK-JS-MOMENT-19821607",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"zolbooo"
],
"semver": {
"vulnerable": [
"<2.31.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.31.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "moment",
"references": [
{
"url": "https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-16T05:58:35.545204Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T05:58:40.122135Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T05:58:40.122135Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T05:58:35.545204Z"
}
],
"description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal in the `locale()` function, whose locale name validation is circumvented by a non-string value, so an object can direct the load to an attacker-specified path. An attacker can cause a file to be loaded from a path of their choosing by supplying a non-string value that the application passes to `moment.locale()`. This requires the application to hand user-supplied non-string input directly to `moment.locale()`, plain strings are unaffected because the existing validation rejects those containing path separators, and only server-side npm consumers are in scope.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2022-24785](https://security.snyk.io/vuln/SNYK-JS-MOMENT-2440688).\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.31.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw)\n- [GitHub Commit](https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07)\n",
"epssDetails": {
"percentile": "0.29054",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-17495"
],
"CWE": [
"CWE-27"
],
"GHSA": [
"GHSA-4p3w-j4w9-5jqw"
]
},
"packageName": "moment",
"proprietary": false,
"creationTime": "2026-09-15T09:03:35.671027Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:18:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T09:03:35.864137Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T05:58:40.122135Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"moment@2.30.1"
],
"upgradePath": [
false,
"moment@2.31.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "moment",
"version": "2.30.1"
},
{
"id": "SNYK-JS-MOMENT-19821607",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"zolbooo"
],
"semver": {
"vulnerable": [
"<2.31.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.31.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "moment",
"references": [
{
"url": "https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-16T05:58:35.545204Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T05:58:40.122135Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T05:58:40.122135Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T05:58:35.545204Z"
}
],
"description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal in the `locale()` function, whose locale name validation is circumvented by a non-string value, so an object can direct the load to an attacker-specified path. An attacker can cause a file to be loaded from a path of their choosing by supplying a non-string value that the application passes to `moment.locale()`. This requires the application to hand user-supplied non-string input directly to `moment.locale()`, plain strings are unaffected because the existing validation rejects those containing path separators, and only server-side npm consumers are in scope.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2022-24785](https://security.snyk.io/vuln/SNYK-JS-MOMENT-2440688).\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.31.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw)\n- [GitHub Commit](https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07)\n",
"epssDetails": {
"percentile": "0.29054",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-17495"
],
"CWE": [
"CWE-27"
],
"GHSA": [
"GHSA-4p3w-j4w9-5jqw"
]
},
"packageName": "moment",
"proprietary": false,
"creationTime": "2026-09-15T09:03:35.671027Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:18:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T09:03:35.864137Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T05:58:40.122135Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"package.json@*",
"moment-timezone@0.5.48",
"moment@2.30.1"
],
"upgradePath": [
false,
"moment-timezone@0.5.48",
"moment@2.31.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "moment",
"version": "2.30.1"
}
],
"ok": false,
"dependencyCount": 546,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "yarn",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "45 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T12:29:11.784985Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T12:29:11.784985Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"webpack@5.104.1",
"browserslist@4.28.1"
],
"upgradePath": [
false,
"webpack@5.104.1",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "browserslist",
"version": "4.28.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:04:09.228841Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.39872",
"probability": "0.00474",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:04:09.228841Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"webpack@5.104.1",
"browserslist@4.28.1"
],
"upgradePath": [
false,
"webpack@5.104.1",
"browserslist@4.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "browserslist",
"version": "4.28.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-DEEPMERGE-19964053",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
">=4.2.0"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "deepmerge",
"references": [
{
"url": "https://github.com/TehShrike/deepmerge/issues/273",
"title": "GitHub Issue"
},
{
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js%23L39-L60",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T11:33:32.796356Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:41.878560Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `deepmerge`.\n## References\n- [GitHub Issue](https://github.com/TehShrike/deepmerge/issues/273)\n- [Vulnerable Code](https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60)\n",
"epssDetails": {
"percentile": "0.29959",
"probability": "0.00361",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93753"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "deepmerge",
"proprietary": false,
"creationTime": "2026-09-20T11:33:32.488257Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47.949000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:33:32.661140Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-20T11:33:32.796356Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"webpack-assets-manifest@6.5.0",
"deepmerge@4.3.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "deepmerge",
"version": "4.3.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:22.121344Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.13894",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:22.121344Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.065847Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.13893",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.065847Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:20.045360Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:20.045360Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:44:08.050420Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.12328",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:44:08.050420Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T14:03:29.269522Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13139",
"probability": "0.00226",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-03T14:03:29.269522Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"webpack@5.104.1",
"terser-webpack-plugin@5.4.0",
"schema-utils@4.3.3",
"ajv@8.18.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"webpack@5.104.1",
"terser-webpack-plugin@5.6.1",
"schema-utils@4.5.0",
"ajv@8.20.0",
"fast-uri@3.1.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"package.json@*",
"shakapacker@9.7.0",
"js-yaml@4.3.1"
],
"upgradePath": [
false,
"shakapacker@9.7.0",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "js-yaml",
"version": "4.3.1",
"severityWithCritical": "high"
}
],
"upgrade": {
"moment@2.30.1": {
"upgradeTo": "moment@2.31.0",
"upgrades": [
"moment@2.30.1"
],
"vulns": [
"SNYK-JS-MOMENT-19821607"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 10,
"targetFile": "/opt/scopear/app/package.json",
"projectName": "package.json",
"displayTargetFile": "/opt/scopear/app/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 1,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/usr/local/lib/node_modules",
"projectName": "lib",
"displayTargetFile": "/usr/local/lib/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 1,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/opt/scopear/.npm-global/lib/node_modules",
"projectName": "lib",
"displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 0,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "maven",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/usr/local/bundle/gems/concurrent-ruby-1.3.7/lib/concurrent-ruby/concurrent",
"projectName": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531:/usr/local/bundle/gems/concurrent-ruby-1.3.7/lib/concurrent-ruby/concurrent",
"displayTargetFile": "/usr/local/bundle/gems/concurrent-ruby-1.3.7/lib/concurrent-ruby/concurrent",
"hasUnknownVersions": false,
"path": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531/scopear/scope-cms:3.46.1_bc479f0.1531:/usr/local/bundle/gems/concurrent-ruby-1.3.7/lib/concurrent-ruby/concurrent"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 0,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "maven",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/usr/share/java",
"projectName": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531:/usr/share/java",
"displayTargetFile": "/usr/share/java",
"hasUnknownVersions": false,
"path": "docker.io/scopear/scope-cms:3.46.1_bc479f0.1531/scopear/scope-cms:3.46.1_bc479f0.1531:/usr/share/java"
}
]
}