{
"vulnerabilities": [
{
"id": "SNYK-UBUNTU2204-NODEJS-17268893",
"cpes": [],
"title": "CVE-2026-45447",
"CVSSv3": null,
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": null,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447"
},
{
"url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt",
"title": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25237",
"title": "https://access.redhat.com/errata/RHSA-2026:25237"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239",
"title": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26275",
"title": "https://access.redhat.com/errata/RHSA-2026:26275"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26319",
"title": "https://access.redhat.com/errata/RHSA-2026:26319"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:29197",
"title": "https://access.redhat.com/errata/RHSA-2026:29197"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34102",
"title": "https://access.redhat.com/errata/RHSA-2026:34102"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35869",
"title": "https://access.redhat.com/errata/RHSA-2026:35869"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36215",
"title": "https://access.redhat.com/errata/RHSA-2026:36215"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36217",
"title": "https://access.redhat.com/errata/RHSA-2026:36217"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39009",
"title": "https://access.redhat.com/errata/RHSA-2026:39009"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39012",
"title": "https://access.redhat.com/errata/RHSA-2026:39012"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39981",
"title": "https://access.redhat.com/errata/RHSA-2026:39981"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45447",
"title": "https://access.redhat.com/security/cve/CVE-2026-45447"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json",
"title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:44438",
"title": "https://access.redhat.com/errata/RHSA-2026:44438"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47735",
"title": "https://access.redhat.com/errata/RHSA-2026:47735"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47737",
"title": "https://access.redhat.com/errata/RHSA-2026:47737"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58563",
"title": "https://access.redhat.com/errata/RHSA-2026:58563"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58981",
"title": "https://access.redhat.com/errata/RHSA-2026:58981"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59831",
"title": "https://access.redhat.com/errata/RHSA-2026:59831"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:66524",
"title": "https://access.redhat.com/errata/RHSA-2026:66524"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"cvssSources": [
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n",
"epssDetails": {
"percentile": "0.90162",
"probability": "0.04002",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-45447"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": null,
"packageName": "nodejs",
"creationTime": "2026-06-10T02:46:34.655313Z",
"disclosureTime": "2026-06-09T17:17:19.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-06-10T02:46:34.660471Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-09-25T21:42:07.304624Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-ai-server@2.51.7_71819fb.4373",
"nodejs@24.21.0-1nodesource1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "nodejs",
"version": "24.21.0-1nodesource1"
},
{
"id": "SNYK-UBUNTU2204-NODEJS-20266986",
"cpes": [],
"title": "CVE-2026-84782",
"CVSSv3": null,
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": null,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782"
},
{
"url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943",
"title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943"
},
{
"url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628",
"title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628"
},
{
"url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58",
"title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58"
},
{
"url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c",
"title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c"
},
{
"url": "https://openssl-library.org/news/secadv/20260929.txt",
"title": "https://openssl-library.org/news/secadv/20260929.txt"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-30T05:53:20.212801Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-03T11:01:35.528611Z"
}
],
"cvssSources": [
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:53:20.212801Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-03T11:01:35.528611Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n",
"epssDetails": {
"percentile": "0.30690",
"probability": "0.00390",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84782"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": null,
"packageName": "nodejs",
"creationTime": "2026-09-30T03:05:00.936532Z",
"disclosureTime": "2026-09-29T16:17:12.500000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-09-30T03:05:00.939158Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-10-03T11:01:36.139633Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-ai-server@2.51.7_71819fb.4373",
"nodejs@24.21.0-1nodesource1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "nodejs",
"version": "24.21.0-1nodesource1"
}
],
"ok": false,
"dependencyCount": 141,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "deb",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {
"binariesVulns": {
"issuesData": {},
"affectedPkgs": {}
},
"os": {
"prettyName": "Ubuntu 22.04.5 LTS"
}
},
"summary": "2 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 2,
"projectName": "docker-image|docker.io/scopear/docker-ai-server",
"platform": "linux/amd64",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-ai-server:2.51.7_71819fb.4373/scopear/docker-ai-server",
"applications": [
{
"vulnerabilities": [
{
"id": "SNYK-JS-AXIOS-20245042",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"groot"
],
"semver": {
"vulnerable": [
">=1.16.1 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:23.137183Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:38:12.806890Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:38:12.806890Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:23.137183Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via improper validation of runtime options in `resolveConfig` and related helpers, where an attacker-controlled or malformed configuration value can trigger a crash in the request processing pipeline. The hardening of option handling across `fetch.js`, `http.js`, `dispatchRequest.js`, and supporting helpers indicates that unsanitized option objects could be passed through to the underlying fetch or HTTP adapter in a way that causes an unhandled runtime error, crashing the process and denying service to other users.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r)\n",
"epssDetails": {
"percentile": "0.29698",
"probability": "0.00382",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101903"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c29m-xwm3-cm6r"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:43:27.441172Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:24Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:43:27.601734Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:38:12.806890Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245044",
"title": "Improper Validation of Specified Quantity in Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"RelunSec"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:38:20.852962Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:38:20.852962Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization or allowlist enforcement. An attacker who can influence request configuration can supply option values that override Axios-owned fields (such as `signal`, `method`, `headers`, or `body`) or inject unexpected fetch option keys, causing the request pipeline to crash and producing a denial of service.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8)\n",
"epssDetails": {
"percentile": "0.29838",
"probability": "0.00384",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101901"
],
"CWE": [
"CWE-1284"
],
"GHSA": [
"GHSA-542g-h47m-68v8"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:49:45.410625Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:43Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:49:45.572984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:38:20.852962Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245046",
"title": "Improper Validation of Specified Quantity in Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"RelunSec"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:39.672628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:39.672628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization or allowlist enforcement. An attacker who can influence request configuration can supply option values that override Axios-owned fields (such as `signal`, `method`, `headers`, or `body`) or inject unexpected fetch option keys, causing the request pipeline to crash and producing a denial of service.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8)\n",
"epssDetails": {
"percentile": "0.29838",
"probability": "0.00384",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101901"
],
"CWE": [
"CWE-1284"
],
"GHSA": [
"GHSA-542g-h47m-68v8"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:55:07.211008Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:43Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:55:07.384339Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:39.672628Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245048",
"title": "Unintended Proxy or Intermediary ('Confused Deputy')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"credit": [
"David Carliez"
],
"semver": {
"vulnerable": [
">=1.15.2 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-29T05:42:56.881452Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.6,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:48.255859Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:48.255859Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:56.881452Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via insufficient hardening of runtime option handling in the fetch and HTTP adapters (`lib/adapters/fetch.js`, `lib/adapters/http.js`, and related helpers). An authenticated attacker can supply malicious request options that are passed through without sanitization, allowing them to override Axios-controlled fetch properties such as `body`, `headers`, `method`, `signal`, `duplex`, and `credentials`, leading to a full compromise of request confidentiality and integrity.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3)\n",
"epssDetails": {
"percentile": "0.19290",
"probability": "0.00289",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101905"
],
"CWE": [
"CWE-441"
],
"GHSA": [
"GHSA-m8m8-qj5v-23w3"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:55:52.908103Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:23Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:55:53.121095Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:48.255859Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245056",
"title": "Unintended Proxy or Intermediary ('Confused Deputy')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"credit": [
"McDubh"
],
"semver": {
"vulnerable": [
">=1.17.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-29T05:42:50.608977Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:09.975186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:09.975186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:50.608977Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via improper enforcement of `maxRedirects: 0` in the fetch adapter, where user-supplied `fetchOptions` are merged into the resolved request options without defaulting the `redirect` field. When a caller sets `maxRedirects: 0` to prevent redirects, the fetch adapter does not apply `redirect: 'manual'` unless the caller also explicitly sets `fetchOptions.redirect`, causing the underlying fetch runtime to silently follow a `302` redirect from the initial target and forward the request - including any credentials or sensitive headers - to the redirect destination, which may be attacker-controlled.\r\n\r\n**Note:** This is only exploitable when requests are configured with `maxRedirects: 0` but without `fetchOptions.redirect: 'manual'` or an equivalent runtime-specific redirect control.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh)\n",
"epssDetails": {
"percentile": "0.33172",
"probability": "0.00414",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101907"
],
"CWE": [
"CWE-441"
],
"GHSA": [
"GHSA-r4gj-5m52-g5wh"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:02:07.482079Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T19:32:38Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:02:07.647927Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:09.975186Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245060",
"title": "Server-side Request Forgery (SSRF)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"credit": [
"HamdaanAliQuatil"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.8,
"modificationTime": "2026-09-29T05:42:44.788930Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:27.159529Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:27.159529Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:44.788930Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via unsafe merging of user-supplied `fetchOptions` into the resolved request options object in `lib/adapters/fetch.js`. An attacker who controls request configuration can supply a `fetchOptions` object with prototype-polluting keys (e.g. `__proto__` or `constructor`), which are spread directly into the options passed to the Fetch API without sanitization, allowing pollution of `Object.prototype` and affecting downstream system-level behaviour. The fix replaces the spread with `Object.assign(Object.create(null), fetchOptions)` to strip inherited properties and enforces an allowlist of safe Fetch API keys.\r\n\r\n**Note:** This is only exploitable when the attacker can influence the `fetchOptions` configuration passed to axios requests.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v)\n",
"epssDetails": {
"percentile": "0.42391",
"probability": "0.00527",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101898"
],
"CWE": [
"CWE-918"
],
"GHSA": [
"GHSA-3pq3-5fj3-cg6v"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:08:29.503613Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:40Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:08:29.828583Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:27.159529Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245062",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"zaneins"
],
"semver": {
"vulnerable": [
">=1.15.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:43:00.363038Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:35.786750Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:35.786750Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:43:00.363038Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization. An attacker who can influence request configuration can trigger uncontrolled resource consumption, crashing the process.\r\n\r\n**Note:** This is only exploitable when requests follow redirects (i.e., `maxRedirects` is not set to `0`), unless application code manually follows the malicious redirect and re-enters axios.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj)\n",
"epssDetails": {
"percentile": "0.31831",
"probability": "0.00402",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101906"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mghh-pgcx-3jjj"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:09:30.186140Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:27Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:09:30.380901Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:35.786750Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245066",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P",
"credit": [
"Barnabas Charumbuka"
],
"semver": {
"vulnerable": [
">=0.28.0 <0.34.0",
">=1.15.1 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.34.0",
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-29T05:42:48.026289Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:13.180160Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:13.180160Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:48.026289Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling across multiple request-processing helpers (`lib/helpers/resolveConfig.js`, `lib/helpers/toFormData.js`, `lib/adapters/fetch.js`, and related files). An attacker can supply a manipulated configuration object that overrides internally owned fetch options (such as `body`, `headers`, `method`, `signal`) or bypasses the default `formSerializer.maxDepth` limit, leading to integrity violations in outgoing requests or a crash causing denial of service.\r\n\r\n**Note:** This is only exploitable when the caller does not explicitly set `formSerializer.maxDepth`, allowing a prototype-level or caller-supplied value to override the expected default.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 0.34.0, 1.20.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f)\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub Commit](https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n",
"epssDetails": {
"percentile": "0.26599",
"probability": "0.00354",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101909"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-x97p-jq2g-jp4f"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:23:19.571870Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T19:32:44Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:23:19.790565Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:13.180160Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"minimatch@3.1.5",
"brace-expansion@1.1.18"
],
"upgradePath": [
false,
"eslint@10.0.0",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.18"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"minimatch@3.1.5",
"brace-expansion@1.1.18"
],
"upgradePath": [
false,
"eslint@10.0.0",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.18"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"@eslint/eslintrc@2.1.4",
"minimatch@3.1.5",
"brace-expansion@1.1.18"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.18"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"@eslint/eslintrc@2.1.4",
"minimatch@3.1.5",
"brace-expansion@1.1.18"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.18"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"@humanwhocodes/config-array@0.11.14",
"minimatch@3.1.5",
"brace-expansion@1.1.18"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.18"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"@humanwhocodes/config-array@0.11.14",
"minimatch@3.1.5",
"brace-expansion@1.1.18"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.18"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"file-entry-cache@6.0.1",
"flat-cache@3.2.0",
"rimraf@3.0.2",
"glob@7.2.3",
"minimatch@3.1.5",
"brace-expansion@1.1.18"
],
"upgradePath": [
false,
"eslint@10.0.0",
"file-entry-cache@8.0.0",
"flat-cache@4.0.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.18"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"file-entry-cache@6.0.1",
"flat-cache@3.2.0",
"rimraf@3.0.2",
"glob@7.2.3",
"minimatch@3.1.5",
"brace-expansion@1.1.18"
],
"upgradePath": [
false,
"eslint@10.0.0",
"file-entry-cache@8.0.0",
"flat-cache@4.0.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.18"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:20:22.507520Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:20:22.507520Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.31182",
"probability": "0.00398",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:22.507520Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.583724Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.583724Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.12670",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.583724Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.341200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.341200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.11273",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.341200Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.341156Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.341156Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.11273",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.341156Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:22.625042Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:22.625042Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13468",
"probability": "0.00239",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:22.625042Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:20:22.507520Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:20:22.507520Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.31182",
"probability": "0.00398",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:22.507520Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.583724Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.583724Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.12670",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.583724Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.341200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.341200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.11273",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.341200Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.341156Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.341156Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.11273",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.341156Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:22.625042Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:22.625042Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13468",
"probability": "0.00239",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:22.625042Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "fast-uri",
"version": "3.1.5"
},
{
"id": "SNYK-JS-HANDLEBARS-20557395",
"title": "Incomplete List of Disallowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Brandon T. Elliott"
],
"semver": {
"vulnerable": [
">=4.6.0 <4.7.10"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the `lookupProperty` function in `lib/handlebars/runtime.js`, which returns the resolved value as soon as `Object.prototype.hasOwnProperty.call(parent, propertyName)` holds, without consulting the prototype access deny list, and `constructor` is an own property of every prototype object, so `Function.prototype.constructor` resolves to `Function` itself. An attacker can execute code on the server by rendering a template that walks to a prototype and reads its constructor, as in `{{lookup (lookup fn \"__proto__\") \"constructor\"}}`. This requires the attacker to control the template rather than only the data, and compilation with `allowProtoMethodsByDefault: true`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by leaving `allowProtoMethodsByDefault` at its default of false when compiling untrusted templates.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.33286",
"probability": "0.00411",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106445"
],
"CWE": [
"CWE-184"
],
"GHSA": [
"GHSA-p8wg-vrv2-v86f"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-07T12:22:11.306334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T21:16:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T12:22:11.534110Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:00.379948Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.53",
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-HANDLEBARS-20574183",
"title": "Access of Resource Using Incompatible Type ('Type Confusion')",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Nick Mykhailyshyn",
"bhaswanthc",
"Lương Nguyễn Ngọc Đình",
"jmoritzc53",
"n0tra4e",
"hibrian827",
"Thai Son Dinh",
"Nikola Kojic",
"Ahmed Elmahgob",
"vk-can",
"PellaML",
"shenhuanageshei",
"kagebunsher",
"kustundag",
"ffasterss",
"sanmatte"
],
"semver": {
"vulnerable": [
">=4.0.0 <4.7.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the compiler's handling of pre-parsed AST objects passed to `compile` or `precompile`. When a caller supplies a hand-built or attacker-influenced AST directly to the compiler, AST node values such as path depths, path parts, literal values, content strings, hash pair keys, and block params are written into generated JavaScript code without sufficient validation, allowing an attacker to inject arbitrary code into the compiled template output. The fix moves all AST value validation into the compiler itself, so that values are checked at the point they are written into generated code rather than only at parse time.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.49055",
"probability": "0.00640",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106446"
],
"CWE": [
"CWE-843",
"CWE-94"
],
"GHSA": [
"GHSA-8r5x-fm3f-whwj"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-08T21:01:07.219662Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-08T17:52:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-08T21:01:07.443371Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:04.407777Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.53",
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"js-yaml@4.3.1"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"js-yaml@4.3.1"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"js-yaml@4.3.1"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.53",
"js-yaml@5.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.1"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.1"
},
{
"id": "SNYK-JS-MAMMOTH-20074633",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=1.11.0 <1.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.4,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "mammoth",
"references": [
{
"url": "https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16",
"title": "GitHub Commit"
},
{
"url": "https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWS",
"title": "raw.githubusercontent.com"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.4,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:29.201259Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:29.201259Z"
}
],
"description": "## Overview\n[mammoth](https://www.npmjs.org/package/mammoth) is a Convert Word documents from docx to simple HTML and Markdown\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `readStylesXml` function in `lib/docx/styles-reader.js` when processing a document's embedded styles. The function previously used a plain object as a lookup map to dispatch style types, allowing an attacker to supply a document with a style whose `w:type` attribute is set to `__proto__` or another inherited property, thereby polluting `Object.prototype`. The patch replaces the object-keyed dispatch with an explicit `switch` statement, and the NEWS entry confirms that successful exploitation could set `externalFileAccess` to `true`.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `mammoth` to version 1.12.2 or higher.\n## References\n- [GitHub Commit](https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53e)\n- [GitHub Commit](https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16)\n- [raw.githubusercontent.com](https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWS)\n",
"epssDetails": {
"percentile": "0.26522",
"probability": "0.00355",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-97151"
],
"CWE": [
"CWE-1321"
]
},
"packageName": "mammoth",
"proprietary": false,
"creationTime": "2026-09-24T08:01:33.212150Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-24T03:58:18.653000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-24T08:01:33.420594Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:29.201259Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0"
],
"upgradePath": [
false,
"mammoth@1.12.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "mammoth",
"version": "1.12.0"
},
{
"id": "SNYK-JS-MAMMOTH-20510281",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.12.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.12.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "mammoth",
"references": [
{
"url": "https://github.com/mwilliamson/mammoth.js",
"title": "github.com"
},
{
"url": "https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/mwilliamson/mammoth.js/issues/487",
"title": "GitHub Issue"
},
{
"url": "https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js%23L6-L30",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-05T01:30:41.162271Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-05T14:04:12.420171Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-05T14:04:12.420171Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-05T01:30:41.162271Z"
}
],
"description": "## Overview\n[mammoth](https://www.npmjs.org/package/mammoth) is a Convert Word documents from docx to simple HTML and Markdown\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the style map tokeniser in `lib/styles/parser/tokeniser.js` due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `mammoth` to version 1.12.3 or higher.\n## References\n- [github.com](https://github.com/mwilliamson/mammoth.js)\n- [GitHub Commit](https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4)\n- [GitHub Issue](https://github.com/mwilliamson/mammoth.js/issues/487)\n- [Vulnerable Code](https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js#L6-L30)\n",
"epssDetails": {
"percentile": "0.27252",
"probability": "0.00358",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-105219"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "mammoth",
"proprietary": false,
"creationTime": "2026-10-05T09:34:02.878744Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-04T18:25:54.366000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:34:03.045031Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-05T14:04:12.420171Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"mammoth@1.12.0"
],
"upgradePath": [
false,
"mammoth@1.12.3"
],
"isUpgradable": true,
"isPatchable": false,
"name": "mammoth",
"version": "1.12.0"
},
{
"id": "SNYK-JS-MODELCONTEXTPROTOCOLSDK-20579853",
"title": "Insufficiently Protected Credentials",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=1.12.0 <1.31.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.31.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@modelcontextprotocol/sdk",
"references": [
{
"url": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2887",
"title": "GitHub PR"
},
{
"url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-08T05:36:13.989019Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-08T21:12:20.436919Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T21:12:20.436919Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:36:13.989019Z"
}
],
"description": "## Overview\n[@modelcontextprotocol/sdk](https://www.npmjs.org/package/@modelcontextprotocol/sdk) is a Model Context Protocol implementation for TypeScript\n\nAffected versions of this package are vulnerable to Insufficiently Protected Credentials via the `fetchToken` and `discardIfIssuerMismatch` functions in the OAuth client authentication flow, where the SEP-2352 issuer check is not applied consistently. An attacker controlling a malicious authorization server can cause the client to send OAuth client credentials (client information) to an unintended server, because the issuer stamp on stored credentials is not validated before the token request is dispatched. This allows an attacker to harvest client credentials by redirecting token requests to a server whose issuer does not match the one the credentials were originally registered with.\n## Remediation\nUpgrade `@modelcontextprotocol/sdk` to version 1.31.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h)\n- [GitHub Commit](https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd)\n- [GitHub PR](https://github.com/modelcontextprotocol/typescript-sdk/pull/2887)\n- [GitHub Release](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0)\n",
"epssDetails": {
"percentile": "0.06476",
"probability": "0.00176",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104850"
],
"CWE": [
"CWE-522"
],
"GHSA": [
"GHSA-6qxp-vccf-f47h"
]
},
"packageName": "@modelcontextprotocol/sdk",
"proprietary": false,
"creationTime": "2026-10-08T21:12:19.087884Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T15:35:44Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-08T21:12:19.530269Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T21:12:20.436919Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.31.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@modelcontextprotocol/sdk",
"version": "1.29.0"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"body-parser@2.3.0",
"qs@6.16.0"
],
"upgradePath": [
false,
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.16.0"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"express@5.2.1",
"qs@6.16.0"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"express@5.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.16.0"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.0"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"express@5.3.0",
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.16.0"
},
{
"id": "SNYK-JS-SHARP-20552492",
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P",
"credit": [
"Rafael B. Dias"
],
"semver": {
"vulnerable": [
"<0.35.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.35.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236",
"title": "GitHub Commit"
},
{
"url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241",
"title": "GitLab Work Item"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279",
"title": "Red Hat Bugzilla Bug"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html",
"title": "RustSec Advisory"
},
{
"url": "https://github.com/rafabd1/VectorFreed",
"title": "PoC in GitHub"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-24T01:31:00.638194Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-24T05:38:15.426615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-10-12T14:04:41.725598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-12T14:04:41.725598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T01:31:00.638194Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:15.426615Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Use After Free in `entity_insert()` and the entity map held on `XmlState`, which is shared between the outer parse and a recursive XInclude, so inserting an entity whose name already exists replaces the first entry and its `Drop` implementation calls `xmlFreeNode()` while the outer `xmlCtxtParseEntity()` is still using that 144 byte `xmlEntity`. An attacker can corrupt process memory by supplying an SVG document whose `xi:include` pulls in another document redefining an entity that is already active. This requires the application to parse attacker supplied SVG with XInclude processing reached, and the entity names must collide across the outer document and the included one.\n## Remediation\nUpgrade `sharp` to version 0.35.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w)\n- [GitHub Commit](https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236)\n- [GitLab Work Item](https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2539279)\n- [RustSec Advisory](https://rustsec.org/advisories/RUSTSEC-2026-0305.html)\n- [PoC in GitHub](https://github.com/rafabd1/VectorFreed)\n",
"epssDetails": {
"percentile": "0.03774",
"probability": "0.00151",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-96889"
],
"CWE": [
"CWE-416"
],
"GHSA": [
"GHSA-wq5f-xc86-pv6w"
],
"RUSTSEC": [
"RUSTSEC-2026-0305"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-10-07T08:26:39.430160Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-23T12:00:00Z",
"exploitDetails": {
"sources": [
"PoC in GitHub"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T08:26:39.631665Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-12T14:04:41.725598Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"sharp@0.35.4"
],
"upgradePath": [
false,
"sharp@0.35.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "sharp",
"version": "0.35.4"
},
{
"id": "SNYK-JS-SIMPLEGIT-20335524",
"title": "Arbitrary Command Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"anir0y"
],
"semver": {
"vulnerable": [
"<4.0.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.0.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "simple-git",
"references": [
{
"url": "https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/steveukx/git-js/pull/1193",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-10-09T01:32:01.512489Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:34:31.909764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:34:31.909764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T01:32:01.512489Z"
}
],
"description": "## Overview\n[simple-git](https://www.npmjs.com/package/simple-git) is a light weight interface for running git commands in any node.js application.\n\nAffected versions of this package are vulnerable to Arbitrary Command Injection via the `blockUnsafeOperationsPlugin`, which fails to block dangerous git options (such as `--upload-pack`, `--receive-pack`, and `--exec`) when abbreviated forms of those options are supplied by an attacker. An attacker who can influence the arguments passed to git commands can bypass the plugin's protections and achieve remote code execution.\r\n\r\n**Note:** This is only exploitable when the consumer has not opted in via `unsafe:{allowUnsafePack:true}`, meaning the plugin is active but can be bypassed through abbreviated option names.\n## Remediation\nUpgrade `simple-git` to version 4.0.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5)\n- [GitHub Commit](https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7)\n- [GitHub PR](https://github.com/steveukx/git-js/pull/1193)\n",
"epssDetails": {
"percentile": "0.31608",
"probability": "0.00395",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102827"
],
"CWE": [
"CWE-77"
],
"GHSA": [
"GHSA-858h-whjf-mvg5"
]
},
"packageName": "simple-git",
"proprietary": false,
"creationTime": "2026-09-30T13:04:39.262999Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T20:27:58Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T13:04:39.435624Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:34:31.909764Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"simple-git@3.36.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "simple-git",
"version": "3.36.0"
},
{
"id": "SNYK-JS-SIMPLEGIT-20335531",
"title": "Command Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"sec-reex"
],
"semver": {
"vulnerable": [
">=3.15.0 <4.0.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.0.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "simple-git",
"references": [
{
"url": "https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/steveukx/git-js/pull/1198https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-10-09T01:32:01.380102Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-06T06:03:23.366008Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:00:56.013054Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:00:56.013054Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T01:32:01.380102Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T06:03:23.366008Z"
}
],
"description": "## Overview\n[simple-git](https://www.npmjs.com/package/simple-git) is a light weight interface for running git commands in any node.js application.\n\nAffected versions of this package are vulnerable to Command Injection via the `rebase` command handler and the `trailer..cmd`/`trailer..command` configuration keys, which allow an attacker to inject the `-x`/`--exec` flag or a shell-executable trailer command into a spawned Git process. An attacker who can influence the arguments or configuration passed to simple-git can achieve arbitrary command execution on the host system.\n## Remediation\nUpgrade `simple-git` to version 4.0.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh)\n- [GitHub Commit](https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3)\n- [GitHub PR](https://github.com/steveukx/git-js/pull/1198https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh)\n",
"epssDetails": {
"percentile": "0.29383",
"probability": "0.00375",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102828"
],
"CWE": [
"CWE-78"
],
"GHSA": [
"GHSA-x6jw-m9v5-85vh"
]
},
"packageName": "simple-git",
"proprietary": false,
"creationTime": "2026-09-30T13:10:57.148217Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T20:27:56Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T13:10:57.319048Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:00:56.013054Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"simple-git@3.36.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "simple-git",
"version": "3.36.0"
},
{
"id": "SNYK-JS-SIMPLEGIT-20335540",
"title": "Arbitrary Command Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
"<4.0.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.0.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "simple-git",
"references": [
{
"url": "https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/steveukx/git-js/pull/1193",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-02T05:41:12.837074Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:44:06.879359Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:44:06.879359Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T05:41:12.837074Z"
}
],
"description": "## Overview\n[simple-git](https://www.npmjs.com/package/simple-git) is a light weight interface for running git commands in any node.js application.\n\nAffected versions of this package are vulnerable to Arbitrary Command Injection via the `detect-vulnerable-config-writes` path in the `argv-parser` package, where unsanitised arguments passed to `git` commands allow an attacker to inject arbitrary options through abbreviated flag handling. Because `git` accepts abbreviated long options by default, a remote attacker can supply a truncated flag that resolves to a dangerous option (such as `--upload-pack`) and achieve arbitrary command execution on the host running the library.\n## Remediation\nUpgrade `simple-git` to version 4.0.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr)\n- [GitHub Commit](https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7)\n- [GitHub PR](https://github.com/steveukx/git-js/pull/1193)\n",
"epssDetails": {
"percentile": "0.38239",
"probability": "0.00464",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102826"
],
"CWE": [
"CWE-77"
],
"GHSA": [
"GHSA-g4wm-2vf7-vfgr"
]
},
"packageName": "simple-git",
"proprietary": false,
"creationTime": "2026-09-30T13:12:17.408571Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T20:27:51Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T13:12:17.572207Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:44:06.879359Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"simple-git@3.36.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "simple-git",
"version": "3.36.0"
},
{
"id": "SNYK-JS-SIMPLEGITARGVPARSER-20335528",
"title": "Command Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<2.0.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"2.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@simple-git/argv-parser",
"references": [
{
"url": "https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/steveukx/git-js/pull/1201",
"title": "GitHub PR"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T14:04:22.385274Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T14:04:22.385274Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Command Injection via the `prepareEnv` function in `parse-env.ts`, which fails to recognize the `VISUAL` environment variable as a tracked unsafe editor key. Because `VISUAL` is not included in the `GitEnvKeys` map, it is silently discarded before `collectConfigVulnerabilities` inspects the environment, allowing an attacker-controlled `VISUAL` value to bypass the `blockUnsafeOperationsPlugin` spawn guard that would otherwise require the consumer to explicitly opt in to `allowUnsafeEditor`. This bypass permits an attacker who can influence the process environment to inject an arbitrary editor binary, potentially achieving remote code execution.\n## Remediation\nUpgrade `@simple-git/argv-parser` to version 2.0.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c)\n- [GitHub Commit](https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4)\n- [GitHub PR](https://github.com/steveukx/git-js/pull/1201)\n",
"epssDetails": {
"percentile": "0.17950",
"probability": "0.00275",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102829"
],
"CWE": [
"CWE-78"
],
"GHSA": [
"GHSA-v5rq-49vh-5v5c"
]
},
"packageName": "@simple-git/argv-parser",
"proprietary": false,
"creationTime": "2026-09-30T13:09:05.860558Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T20:27:40.733000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T13:09:06.053101Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T14:04:22.385274Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"simple-git@3.36.0",
"@simple-git/argv-parser@1.1.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@simple-git/argv-parser",
"version": "1.1.1"
},
{
"id": "SNYK-JS-UNDICI-21181005",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Eurico Nicacio",
"Sanjeev Kumar",
"BlueN0r"
],
"semver": {
"vulnerable": [
">=4.0.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation via the `Agent` constructor in `lib/dispatcher/agent.js`, where TLS options passed as the `tls` parameter are silently dropped and never stored in `kOptions`. Because the `tls` field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.\n\n## Workaround\n\nUsers who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied `EnvHttpProxyAgent` destinations, use `requestTls / proxyTls`.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07019",
"probability": "0.00180",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109383"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-2m5v-pch6-74hx"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:12:43.591600Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:59:00.559000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:12:43.778208Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.923864Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181009",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid",
"bengsky13"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in `CacheHandler.onResponseStart`, where a redirect to a different origin can cause the final response to be stored under the original (trusted) origin's cache key. An attacker who controls a redirect target can poison the shared cache by serving a response that gets keyed against a URL the application trusts, enabling subsequent cache-served responses to deliver attacker-controlled content. Additionally, intermediate redirect hops carrying restrictive `Cache-Control` directives (such as `no-store` or `private`) are not honored, allowing those hops to be laundered into a cacheable entry under the original key.\n\n**Note:** This is only exploitable when an originless `Agent`, a shared `MemoryCacheStore` or `SqliteCacheStore`, and the composition `compose(redirect(), cache())` are all used.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.03588",
"probability": "0.00148",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109829"
],
"CWE": [
"CWE-346"
],
"GHSA": [
"GHSA-4w7w-5xrc-9h26"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:14:15.451684Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:58.129000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:14:15.622241Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.877149Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181011",
"title": "Improper Handling of Case Sensitivity",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the `fetch()` implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as `SHA256-...` or `Sha256-...` is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.\n\n**Note:** This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., `SHA256`, `Sha384`) in its `integrity` metadata rather than the canonical lowercase forms.\n\n## Workaround\n\nUse lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in all `integrity` metadata passed to `fetch()`.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15179",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109841"
],
"CWE": [
"CWE-178"
],
"GHSA": [
"GHSA-f72v-6w45-q472"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:25.543912Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:55.577000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:25.706632Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.036594Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181013",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=4.2.1 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via unhandled `ERR_TLS_CERT_ALTNAME_INVALID` errors in `onHttpSocketError`, `onHttp2SessionError`, and `onHttp2SocketError`. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed `assert` call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07405",
"probability": "0.00184",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87018"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-qrxm-fqhp-jwvm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:38.122926Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:34.126000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:38.271407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T11:15:38.468693Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181015",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=5.15.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket `ByteParser` receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22070",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109932"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-9fm3-97px-rjf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:43.161817Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:18.018000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:43.310504Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.494426Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181017",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via the `DecompressHandler` in `lib/interceptor/decompress.js`, where an uncaught exception thrown by a downstream handler during `onResponseData` or `onResponseEnd` propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15201",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87029"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-55wc-3pg8-jfw6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:54.262716Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:57:32.262000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:54.415042Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.251949Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181019",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Syed Mohammad Ibrahim"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `EventSourceStream` transform in `lib/web/eventsource/eventsource-stream.js`, where the `maxEventSize` limit is only enforced inside `parseLine()`, which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a `data:` field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22069",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109924"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-4qv8-2p9j-2685"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:59.691676Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:39.827000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:59.844509Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.485058Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21185768",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hanityx"
],
"semver": {
"vulnerable": [
">=6.23.0 <6.29.1",
">=7.18.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:25.657338Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T12:13:09.757051Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T12:13:09.757051Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:25.657338Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via excessive `Content-Encoding` headers in an HTTP response processed by `httpNetworkFetch` in `lib/web/fetch/index.js`. A server returning a response with more than five content-encoding layers triggers an error path that previously called `reject()` before the response body `Readable` stream was initialised, leaving the stream in an inconsistent state and crashing the client process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.26283",
"probability": "0.00343",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109869"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-xjj6-f33q-929c"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T12:13:09.273080Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:36.082000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T12:13:09.432573Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T12:13:09.757051Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181005",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Eurico Nicacio",
"Sanjeev Kumar",
"BlueN0r"
],
"semver": {
"vulnerable": [
">=4.0.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation via the `Agent` constructor in `lib/dispatcher/agent.js`, where TLS options passed as the `tls` parameter are silently dropped and never stored in `kOptions`. Because the `tls` field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.\n\n## Workaround\n\nUsers who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied `EnvHttpProxyAgent` destinations, use `requestTls / proxyTls`.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07019",
"probability": "0.00180",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109383"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-2m5v-pch6-74hx"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:12:43.591600Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:59:00.559000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:12:43.778208Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.923864Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.1"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181009",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid",
"bengsky13"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in `CacheHandler.onResponseStart`, where a redirect to a different origin can cause the final response to be stored under the original (trusted) origin's cache key. An attacker who controls a redirect target can poison the shared cache by serving a response that gets keyed against a URL the application trusts, enabling subsequent cache-served responses to deliver attacker-controlled content. Additionally, intermediate redirect hops carrying restrictive `Cache-Control` directives (such as `no-store` or `private`) are not honored, allowing those hops to be laundered into a cacheable entry under the original key.\n\n**Note:** This is only exploitable when an originless `Agent`, a shared `MemoryCacheStore` or `SqliteCacheStore`, and the composition `compose(redirect(), cache())` are all used.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.03588",
"probability": "0.00148",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109829"
],
"CWE": [
"CWE-346"
],
"GHSA": [
"GHSA-4w7w-5xrc-9h26"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:14:15.451684Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:58.129000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:14:15.622241Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.877149Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.1"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181011",
"title": "Improper Handling of Case Sensitivity",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the `fetch()` implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as `SHA256-...` or `Sha256-...` is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.\n\n**Note:** This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., `SHA256`, `Sha384`) in its `integrity` metadata rather than the canonical lowercase forms.\n\n## Workaround\n\nUse lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in all `integrity` metadata passed to `fetch()`.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15179",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109841"
],
"CWE": [
"CWE-178"
],
"GHSA": [
"GHSA-f72v-6w45-q472"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:25.543912Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:55.577000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:25.706632Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.036594Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.1"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181013",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=4.2.1 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via unhandled `ERR_TLS_CERT_ALTNAME_INVALID` errors in `onHttpSocketError`, `onHttp2SessionError`, and `onHttp2SocketError`. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed `assert` call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07405",
"probability": "0.00184",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87018"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-qrxm-fqhp-jwvm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:38.122926Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:34.126000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:38.271407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T11:15:38.468693Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.1"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181015",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=5.15.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket `ByteParser` receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22070",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109932"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-9fm3-97px-rjf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:43.161817Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:18.018000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:43.310504Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.494426Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.1"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181017",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via the `DecompressHandler` in `lib/interceptor/decompress.js`, where an uncaught exception thrown by a downstream handler during `onResponseData` or `onResponseEnd` propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15201",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87029"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-55wc-3pg8-jfw6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:54.262716Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:57:32.262000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:54.415042Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.251949Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.1"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181019",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Syed Mohammad Ibrahim"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `EventSourceStream` transform in `lib/web/eventsource/eventsource-stream.js`, where the `maxEventSize` limit is only enforced inside `parseLine()`, which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a `data:` field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22069",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109924"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-4qv8-2p9j-2685"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:59.691676Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:39.827000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:59.844509Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.485058Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.1"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21185768",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hanityx"
],
"semver": {
"vulnerable": [
">=6.23.0 <6.29.1",
">=7.18.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:25.657338Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T12:13:09.757051Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T12:13:09.757051Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:25.657338Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via excessive `Content-Encoding` headers in an HTTP response processed by `httpNetworkFetch` in `lib/web/fetch/index.js`. A server returning a response with more than five content-encoding layers triggers an error path that previously called `reject()` before the response body `Readable` stream was initialised, leaving the stream in an inconsistent state and crashing the client process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.26283",
"probability": "0.00343",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109869"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-xjj6-f33q-929c"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T12:13:09.273080Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:36.082000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T12:13:09.432573Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T12:13:09.757051Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"cheerio@1.2.0",
"undici@7.29.1"
],
"upgradePath": [
false,
"cheerio@1.2.0",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181005",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Eurico Nicacio",
"Sanjeev Kumar",
"BlueN0r"
],
"semver": {
"vulnerable": [
">=4.0.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation via the `Agent` constructor in `lib/dispatcher/agent.js`, where TLS options passed as the `tls` parameter are silently dropped and never stored in `kOptions`. Because the `tls` field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.\n\n## Workaround\n\nUsers who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied `EnvHttpProxyAgent` destinations, use `requestTls / proxyTls`.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07019",
"probability": "0.00180",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109383"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-2m5v-pch6-74hx"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:12:43.591600Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:59:00.559000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:12:43.778208Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.923864Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181009",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid",
"bengsky13"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in `CacheHandler.onResponseStart`, where a redirect to a different origin can cause the final response to be stored under the original (trusted) origin's cache key. An attacker who controls a redirect target can poison the shared cache by serving a response that gets keyed against a URL the application trusts, enabling subsequent cache-served responses to deliver attacker-controlled content. Additionally, intermediate redirect hops carrying restrictive `Cache-Control` directives (such as `no-store` or `private`) are not honored, allowing those hops to be laundered into a cacheable entry under the original key.\n\n**Note:** This is only exploitable when an originless `Agent`, a shared `MemoryCacheStore` or `SqliteCacheStore`, and the composition `compose(redirect(), cache())` are all used.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.03588",
"probability": "0.00148",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109829"
],
"CWE": [
"CWE-346"
],
"GHSA": [
"GHSA-4w7w-5xrc-9h26"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:14:15.451684Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:58.129000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:14:15.622241Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.877149Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181011",
"title": "Improper Handling of Case Sensitivity",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the `fetch()` implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as `SHA256-...` or `Sha256-...` is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.\n\n**Note:** This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., `SHA256`, `Sha384`) in its `integrity` metadata rather than the canonical lowercase forms.\n\n## Workaround\n\nUse lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in all `integrity` metadata passed to `fetch()`.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15179",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109841"
],
"CWE": [
"CWE-178"
],
"GHSA": [
"GHSA-f72v-6w45-q472"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:25.543912Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:55.577000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:25.706632Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.036594Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181013",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=4.2.1 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via unhandled `ERR_TLS_CERT_ALTNAME_INVALID` errors in `onHttpSocketError`, `onHttp2SessionError`, and `onHttp2SocketError`. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed `assert` call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07405",
"probability": "0.00184",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87018"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-qrxm-fqhp-jwvm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:38.122926Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:34.126000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:38.271407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T11:15:38.468693Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181015",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=5.15.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket `ByteParser` receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22070",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109932"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-9fm3-97px-rjf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:43.161817Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:18.018000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:43.310504Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.494426Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181017",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via the `DecompressHandler` in `lib/interceptor/decompress.js`, where an uncaught exception thrown by a downstream handler during `onResponseData` or `onResponseEnd` propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15201",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87029"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-55wc-3pg8-jfw6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:54.262716Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:57:32.262000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:54.415042Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.251949Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21181019",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Syed Mohammad Ibrahim"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `EventSourceStream` transform in `lib/web/eventsource/eventsource-stream.js`, where the `maxEventSize` limit is only enforced inside `parseLine()`, which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a `data:` field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22069",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109924"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-4qv8-2p9j-2685"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:59.691676Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:39.827000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:59.844509Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.485058Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-UNDICI-21185768",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hanityx"
],
"semver": {
"vulnerable": [
">=6.23.0 <6.29.1",
">=7.18.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:25.657338Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T12:13:09.757051Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T12:13:09.757051Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:25.657338Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via excessive `Content-Encoding` headers in an HTTP response processed by `httpNetworkFetch` in `lib/web/fetch/index.js`. A server returning a response with more than five content-encoding layers triggers an error path that previously called `reject()` before the response body `Readable` stream was initialised, leaving the stream in an inconsistent state and crashing the client process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.26283",
"probability": "0.00343",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109869"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-xjj6-f33q-929c"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T12:13:09.273080Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:36.082000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T12:13:09.432573Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T12:13:09.757051Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "7.29.1"
},
{
"id": "SNYK-JS-URIJS-19963963",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "uri-js",
"references": [
{
"url": "https://github.com/garycourt/uri-js/issues/105",
"title": "GitHub Issue"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L349",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L352-L376",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:08.601575Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:08.601575Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"description": "## Overview\n[uri-js](https://github.com/garycourt/uri-js) is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.\n\nAffected versions of this package are vulnerable to Infinite loop via the `removeDotSegments` function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to `removeDotSegments` directly, or through the `normalize` or `resolve` functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.\n## Remediation\nThere is no fixed version for `uri-js`.\n## References\n- [GitHub Issue](https://github.com/garycourt/uri-js/issues/105)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376)\n",
"epssDetails": {
"percentile": "0.50451",
"probability": "0.00684",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93690"
],
"CWE": [
"CWE-835"
]
},
"packageName": "uri-js",
"proprietary": false,
"creationTime": "2026-09-20T09:04:44.397511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:20Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T09:04:44.578622Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:08.601575Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"ajv@6.14.0",
"uri-js@4.4.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "uri-js",
"version": "4.4.1"
},
{
"id": "SNYK-JS-URIJS-19963963",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "uri-js",
"references": [
{
"url": "https://github.com/garycourt/uri-js/issues/105",
"title": "GitHub Issue"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L349",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts%23L352-L376",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:08.601575Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:08.601575Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.522367Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:51.138450Z"
}
],
"description": "## Overview\n[uri-js](https://github.com/garycourt/uri-js) is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.\n\nAffected versions of this package are vulnerable to Infinite loop via the `removeDotSegments` function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to `removeDotSegments` directly, or through the `normalize` or `resolve` functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.\n## Remediation\nThere is no fixed version for `uri-js`.\n## References\n- [GitHub Issue](https://github.com/garycourt/uri-js/issues/105)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349)\n- [Vulnerable Code](https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376)\n",
"epssDetails": {
"percentile": "0.50451",
"probability": "0.00684",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93690"
],
"CWE": [
"CWE-835"
]
},
"packageName": "uri-js",
"proprietary": false,
"creationTime": "2026-09-20T09:04:44.397511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:20Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T09:04:44.578622Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:08.601575Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"eslint@8.48.0",
"@eslint/eslintrc@2.1.4",
"ajv@6.14.0",
"uri-js@4.4.1"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "uri-js",
"version": "4.4.1"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"zod@3.25.76"
],
"upgradePath": [
false,
"zod@4.6.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"zod@3.25.76"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/openai@1.4.5",
"zod@3.25.76"
],
"upgradePath": [
false,
"@langchain/openai@1.4.5",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/core@1.2.3",
"zod@3.25.76"
],
"upgradePath": [
false,
"@langchain/core@1.2.3",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"zod@3.25.76"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"langchain@1.5.5",
"zod@3.25.76"
],
"upgradePath": [
false,
"langchain@1.5.5",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"zod@3.25.76"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.53",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/openai@1.4.5",
"zod@3.25.76"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/openai@1.6.2",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"@langchain/openai@1.4.1",
"zod@3.25.76"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.53",
"@langchain/openai@1.6.2",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
}
],
"ok": false,
"dependencyCount": 566,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "78 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-FASTURI-19256867",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"baeseungwon1010"
],
"semver": {
"vulnerable": [
">=2.4.2 <2.4.5",
">=3.1.3 <3.1.6",
">=4.0.1 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:20:22.507520Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:20:22.507520Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:53.591641Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Interpretation Conflict in `resolve()` through the `resolve()` process in `index.js`. An attacker can make an application resolve a scheme-relative reference such as `//host/` against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.\r\n\r\n**Workarounds**\r\n\r\n- Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/0256bc8d1f28b5d0ac657faf67e2411a189dfcb5)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/4e4ebd8b245f6ca16e448203559eea3e545453a3)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)\n",
"epssDetails": {
"percentile": "0.31182",
"probability": "0.00398",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75931"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-5jgf-p345-68v8"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:20:53.051852Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:20:53.332995Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:22.507520Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256869",
"title": "Improper Handling of URL Encoding (Hex Encoding)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"YashvantHange"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.583724Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.583724Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:49.082750Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the `parseWithStatus`, `normalizeStringWithStatus`, `normalizeComparableURI`, and `resolve` paths in `index.js`. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as `%2f%2fevil.example:/pwn`, causing `normalize()` or `resolve()` to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)\n",
"epssDetails": {
"percentile": "0.12670",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76172"
],
"CWE": [
"CWE-177"
],
"GHSA": [
"GHSA-jqff-g426-hqxp"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:21:46.136337Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:21:46.306993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.583724Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256871",
"title": "Improper Validation of Syntactic Correctness of Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=2.3.1 <2.4.5",
">=3.0.0 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799",
"title": "GitHub Commit v2.4.5"
},
{
"url": "https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595",
"title": "GitHub Commit v4.1.3"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.341200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.341200Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.782351Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the `normalizeIPv6()` and `parseWithStatus()` host-processing paths in `lib/utils.js` and `index.js`. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as `http://[::not-valid]/private` before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to `fast-uri`; this prevents malformed IPv6 text from being normalized into a different valid local or private address.\r\n- Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit v2.4.5](https://github.com/fastify/fast-uri/commit/9161eded1ff55fad9d9714c6ad6c0f0283547799)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f)\n- [GitHub Commit v4.1.3](https://github.com/fastify/fast-uri/commit/3728465caacef4b16bc84b7d14760f1c8fe41595)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)\n",
"epssDetails": {
"percentile": "0.11273",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75975"
],
"CWE": [
"CWE-1286"
],
"GHSA": [
"GHSA-f65p-4m7j-42xc"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:23:03.068248Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:23:03.264538Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.341200Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19256873",
"title": "Double Decoding of the Same Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"NotAFlightRisk"
],
"semver": {
"vulnerable": [
">=2.4.1 <2.4.5",
">=3.1.2 <3.1.6",
">=4.0.0 <4.1.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.5",
"3.1.6",
"4.1.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304",
"title": "GitHub Commit"
},
{
"url": "https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514",
"title": "GitHub Commit v3.1.6"
},
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.341156Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.341156Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:41.300704Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in `normalize()` and `resolve()` and the authority recomposition logic in `index.js` and `lib/utils.js`. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so `%25` sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like `localhost` or a cloud metadata endpoint.\r\n\r\n**Workarounds**\r\n\r\n- Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`. This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.\n## Remediation\nUpgrade `fast-uri` to version 2.4.5, 3.1.6, 4.1.3 or higher.\n## References\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/2642290672e7211c990aaed3749c2ce667d0af4f)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/8c15dbe94ec50bb8e595791ebb42c35cef0fd304)\n- [GitHub Commit v3.1.6](https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514)\n- [Maintainer's Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n",
"epssDetails": {
"percentile": "0.11273",
"probability": "0.00220",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-75899"
],
"CWE": [
"CWE-174"
],
"GHSA": [
"GHSA-fph4-wmhf-6fwf"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-08-25T12:24:16.029077Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T15:33:21Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-25T12:24:16.207318Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.341156Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-FASTURI-19502739",
"title": "Improper Encoding or Escaping of Output",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Yashvant Mahadev Hange"
],
"semver": {
"vulnerable": [
"<2.4.6",
">=3.0.0 <3.1.7",
">=4.0.0 <4.1.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.4.6",
"3.1.7",
"4.1.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "fast-uri",
"references": [
{
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:22.625042Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:22.625042Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:54.063442Z"
}
],
"description": "## Overview\n[fast-uri](https://www.npmjs.org/package/fast-uri) is a Dependency-free RFC 3986 URI toolbox\n\nAffected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the `recomposeAuthority` function, which escapes the userinfo and host components but concatenates the `port` field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as `@127.0.0.1:8124`, which demotes the legitimate host to userinfo and yields `http://trusted.example:@127.0.0.1:8124/app`. This requires the application to build URIs from separate components and assign untrusted data directly to the `port` field of an object passed to `serialize()`, `normalize()`, or `equal()`, and ports obtained via `parse()` are unaffected because parsing validates digit-only values.\n## Remediation\nUpgrade `fast-uri` to version 2.4.6, 3.1.7, 4.1.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3)\n- [GitHub Commit](https://github.com/fastify/fast-uri/commit/812bd8e2145d68de75092faf7a5e1c70720dc680)\n",
"epssDetails": {
"percentile": "0.13468",
"probability": "0.00239",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84292"
],
"CWE": [
"CWE-116"
],
"GHSA": [
"GHSA-qw65-cvwx-89v3"
]
},
"packageName": "fast-uri",
"proprietary": false,
"creationTime": "2026-09-03T05:54:43.922814Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T21:34:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-03T05:54:44.160684Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:22.625042Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.5"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"ajv-formats@3.0.1",
"ajv@8.20.0",
"fast-uri@3.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "fast-uri",
"version": "3.1.5",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-HANDLEBARS-20557395",
"title": "Incomplete List of Disallowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Brandon T. Elliott"
],
"semver": {
"vulnerable": [
">=4.6.0 <4.7.10"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the `lookupProperty` function in `lib/handlebars/runtime.js`, which returns the resolved value as soon as `Object.prototype.hasOwnProperty.call(parent, propertyName)` holds, without consulting the prototype access deny list, and `constructor` is an own property of every prototype object, so `Function.prototype.constructor` resolves to `Function` itself. An attacker can execute code on the server by rendering a template that walks to a prototype and reads its constructor, as in `{{lookup (lookup fn \"__proto__\") \"constructor\"}}`. This requires the attacker to control the template rather than only the data, and compilation with `allowProtoMethodsByDefault: true`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by leaving `allowProtoMethodsByDefault` at its default of false when compiling untrusted templates.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.33286",
"probability": "0.00411",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106445"
],
"CWE": [
"CWE-184"
],
"GHSA": [
"GHSA-p8wg-vrv2-v86f"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-07T12:22:11.306334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T21:16:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T12:22:11.534110Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:00.379948Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.53",
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "handlebars",
"version": "4.7.9",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-HANDLEBARS-20574183",
"title": "Access of Resource Using Incompatible Type ('Type Confusion')",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Nick Mykhailyshyn",
"bhaswanthc",
"Lương Nguyễn Ngọc Đình",
"jmoritzc53",
"n0tra4e",
"hibrian827",
"Thai Son Dinh",
"Nikola Kojic",
"Ahmed Elmahgob",
"vk-can",
"PellaML",
"shenhuanageshei",
"kagebunsher",
"kustundag",
"ffasterss",
"sanmatte"
],
"semver": {
"vulnerable": [
">=4.0.0 <4.7.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the compiler's handling of pre-parsed AST objects passed to `compile` or `precompile`. When a caller supplies a hand-built or attacker-influenced AST directly to the compiler, AST node values such as path depths, path parts, literal values, content strings, hash pair keys, and block params are written into generated JavaScript code without sufficient validation, allowing an attacker to inject arbitrary code into the compiled template output. The fix moves all AST value validation into the compiler itself, so that values are checked at the point they are written into generated code rather than only at parse time.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.49055",
"probability": "0.00640",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106446"
],
"CWE": [
"CWE-843",
"CWE-94"
],
"GHSA": [
"GHSA-8r5x-fm3f-whwj"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-08T21:01:07.219662Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-08T17:52:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-08T21:01:07.443371Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:04.407777Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/community@1.1.29",
"@langchain/classic@1.0.27",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"@langchain/community@1.1.29",
"@langchain/classic@1.0.53",
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "handlebars",
"version": "4.7.9",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@modelcontextprotocol/sdk@1.29.0",
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.0"
],
"upgradePath": [
false,
"@modelcontextprotocol/sdk@1.29.0",
"express@5.3.0",
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "qs",
"version": "6.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-SIMPLEGIT-20335524",
"title": "Arbitrary Command Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"anir0y"
],
"semver": {
"vulnerable": [
"<4.0.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.0.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "simple-git",
"references": [
{
"url": "https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/steveukx/git-js/pull/1193",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-10-09T01:32:01.512489Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:34:31.909764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:34:31.909764Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T01:32:01.512489Z"
}
],
"description": "## Overview\n[simple-git](https://www.npmjs.com/package/simple-git) is a light weight interface for running git commands in any node.js application.\n\nAffected versions of this package are vulnerable to Arbitrary Command Injection via the `blockUnsafeOperationsPlugin`, which fails to block dangerous git options (such as `--upload-pack`, `--receive-pack`, and `--exec`) when abbreviated forms of those options are supplied by an attacker. An attacker who can influence the arguments passed to git commands can bypass the plugin's protections and achieve remote code execution.\r\n\r\n**Note:** This is only exploitable when the consumer has not opted in via `unsafe:{allowUnsafePack:true}`, meaning the plugin is active but can be bypassed through abbreviated option names.\n## Remediation\nUpgrade `simple-git` to version 4.0.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-858h-whjf-mvg5)\n- [GitHub Commit](https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7)\n- [GitHub PR](https://github.com/steveukx/git-js/pull/1193)\n",
"epssDetails": {
"percentile": "0.31608",
"probability": "0.00395",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102827"
],
"CWE": [
"CWE-77"
],
"GHSA": [
"GHSA-858h-whjf-mvg5"
]
},
"packageName": "simple-git",
"proprietary": false,
"creationTime": "2026-09-30T13:04:39.262999Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T20:27:58Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T13:04:39.435624Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:34:31.909764Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"simple-git@3.36.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "simple-git",
"version": "3.36.0",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-SIMPLEGIT-20335531",
"title": "Command Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"sec-reex"
],
"semver": {
"vulnerable": [
">=3.15.0 <4.0.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.0.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "simple-git",
"references": [
{
"url": "https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/steveukx/git-js/pull/1198https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-10-09T01:32:01.380102Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-06T06:03:23.366008Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:00:56.013054Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:00:56.013054Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T01:32:01.380102Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T06:03:23.366008Z"
}
],
"description": "## Overview\n[simple-git](https://www.npmjs.com/package/simple-git) is a light weight interface for running git commands in any node.js application.\n\nAffected versions of this package are vulnerable to Command Injection via the `rebase` command handler and the `trailer..cmd`/`trailer..command` configuration keys, which allow an attacker to inject the `-x`/`--exec` flag or a shell-executable trailer command into a spawned Git process. An attacker who can influence the arguments or configuration passed to simple-git can achieve arbitrary command execution on the host system.\n## Remediation\nUpgrade `simple-git` to version 4.0.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh)\n- [GitHub Commit](https://github.com/steveukx/git-js/commit/d762810c13b331ff1e5eb24c0b434646d2a8d1b3)\n- [GitHub PR](https://github.com/steveukx/git-js/pull/1198https://github.com/steveukx/git-js/security/advisories/GHSA-x6jw-m9v5-85vh)\n",
"epssDetails": {
"percentile": "0.29383",
"probability": "0.00375",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102828"
],
"CWE": [
"CWE-78"
],
"GHSA": [
"GHSA-x6jw-m9v5-85vh"
]
},
"packageName": "simple-git",
"proprietary": false,
"creationTime": "2026-09-30T13:10:57.148217Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T20:27:56Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T13:10:57.319048Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:00:56.013054Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"simple-git@3.36.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "simple-git",
"version": "3.36.0",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-SIMPLEGIT-20335540",
"title": "Arbitrary Command Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
"<4.0.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.0.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "simple-git",
"references": [
{
"url": "https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/steveukx/git-js/pull/1193",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-02T05:41:12.837074Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:44:06.879359Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:44:06.879359Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T05:41:12.837074Z"
}
],
"description": "## Overview\n[simple-git](https://www.npmjs.com/package/simple-git) is a light weight interface for running git commands in any node.js application.\n\nAffected versions of this package are vulnerable to Arbitrary Command Injection via the `detect-vulnerable-config-writes` path in the `argv-parser` package, where unsanitised arguments passed to `git` commands allow an attacker to inject arbitrary options through abbreviated flag handling. Because `git` accepts abbreviated long options by default, a remote attacker can supply a truncated flag that resolves to a dangerous option (such as `--upload-pack`) and achieve arbitrary command execution on the host running the library.\n## Remediation\nUpgrade `simple-git` to version 4.0.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-g4wm-2vf7-vfgr)\n- [GitHub Commit](https://github.com/steveukx/git-js/commit/98864c678444d9336357c844efa4fd5a7984c0d7)\n- [GitHub PR](https://github.com/steveukx/git-js/pull/1193)\n",
"epssDetails": {
"percentile": "0.38239",
"probability": "0.00464",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102826"
],
"CWE": [
"CWE-77"
],
"GHSA": [
"GHSA-g4wm-2vf7-vfgr"
]
},
"packageName": "simple-git",
"proprietary": false,
"creationTime": "2026-09-30T13:12:17.408571Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T20:27:51Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T13:12:17.572207Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:44:06.879359Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"simple-git@3.36.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "simple-git",
"version": "3.36.0",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-SIMPLEGITARGVPARSER-20335528",
"title": "Command Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<2.0.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"2.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@simple-git/argv-parser",
"references": [
{
"url": "https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/steveukx/git-js/pull/1201",
"title": "GitHub PR"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T14:04:22.385274Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T14:04:22.385274Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Command Injection via the `prepareEnv` function in `parse-env.ts`, which fails to recognize the `VISUAL` environment variable as a tracked unsafe editor key. Because `VISUAL` is not included in the `GitEnvKeys` map, it is silently discarded before `collectConfigVulnerabilities` inspects the environment, allowing an attacker-controlled `VISUAL` value to bypass the `blockUnsafeOperationsPlugin` spawn guard that would otherwise require the consumer to explicitly opt in to `allowUnsafeEditor`. This bypass permits an attacker who can influence the process environment to inject an arbitrary editor binary, potentially achieving remote code execution.\n## Remediation\nUpgrade `@simple-git/argv-parser` to version 2.0.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c)\n- [GitHub Commit](https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4)\n- [GitHub PR](https://github.com/steveukx/git-js/pull/1201)\n",
"epssDetails": {
"percentile": "0.17950",
"probability": "0.00275",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102829"
],
"CWE": [
"CWE-78"
],
"GHSA": [
"GHSA-v5rq-49vh-5v5c"
]
},
"packageName": "@simple-git/argv-parser",
"proprietary": false,
"creationTime": "2026-09-30T13:09:05.860558Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T20:27:40.733000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T13:09:06.053101Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T14:04:22.385274Z",
"socialTrendAlert": false,
"packagePopularityRank": 98,
"from": [
"server@1.0.0",
"node-llama-cpp@3.18.1",
"simple-git@3.36.0",
"@simple-git/argv-parser@1.1.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@simple-git/argv-parser",
"version": "1.1.1",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDICI-21181005",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Eurico Nicacio",
"Sanjeev Kumar",
"BlueN0r"
],
"semver": {
"vulnerable": [
">=4.0.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation via the `Agent` constructor in `lib/dispatcher/agent.js`, where TLS options passed as the `tls` parameter are silently dropped and never stored in `kOptions`. Because the `tls` field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.\n\n## Workaround\n\nUsers who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied `EnvHttpProxyAgent` destinations, use `requestTls / proxyTls`.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07019",
"probability": "0.00180",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109383"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-2m5v-pch6-74hx"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:12:43.591600Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:59:00.559000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:12:43.778208Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.923864Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.1",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDICI-21181009",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid",
"bengsky13"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in `CacheHandler.onResponseStart`, where a redirect to a different origin can cause the final response to be stored under the original (trusted) origin's cache key. An attacker who controls a redirect target can poison the shared cache by serving a response that gets keyed against a URL the application trusts, enabling subsequent cache-served responses to deliver attacker-controlled content. Additionally, intermediate redirect hops carrying restrictive `Cache-Control` directives (such as `no-store` or `private`) are not honored, allowing those hops to be laundered into a cacheable entry under the original key.\n\n**Note:** This is only exploitable when an originless `Agent`, a shared `MemoryCacheStore` or `SqliteCacheStore`, and the composition `compose(redirect(), cache())` are all used.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.03588",
"probability": "0.00148",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109829"
],
"CWE": [
"CWE-346"
],
"GHSA": [
"GHSA-4w7w-5xrc-9h26"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:14:15.451684Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:58.129000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:14:15.622241Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.877149Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.1",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDICI-21181011",
"title": "Improper Handling of Case Sensitivity",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the `fetch()` implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as `SHA256-...` or `Sha256-...` is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.\n\n**Note:** This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., `SHA256`, `Sha384`) in its `integrity` metadata rather than the canonical lowercase forms.\n\n## Workaround\n\nUse lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in all `integrity` metadata passed to `fetch()`.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15179",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109841"
],
"CWE": [
"CWE-178"
],
"GHSA": [
"GHSA-f72v-6w45-q472"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:25.543912Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:55.577000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:25.706632Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.036594Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181013",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=4.2.1 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via unhandled `ERR_TLS_CERT_ALTNAME_INVALID` errors in `onHttpSocketError`, `onHttp2SessionError`, and `onHttp2SocketError`. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed `assert` call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07405",
"probability": "0.00184",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87018"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-qrxm-fqhp-jwvm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:38.122926Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:34.126000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:38.271407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T11:15:38.468693Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181015",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=5.15.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket `ByteParser` receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22070",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109932"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-9fm3-97px-rjf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:43.161817Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:18.018000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:43.310504Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.494426Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181017",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via the `DecompressHandler` in `lib/interceptor/decompress.js`, where an uncaught exception thrown by a downstream handler during `onResponseData` or `onResponseEnd` propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15201",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87029"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-55wc-3pg8-jfw6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:54.262716Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:57:32.262000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:54.415042Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.251949Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181019",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Syed Mohammad Ibrahim"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `EventSourceStream` transform in `lib/web/eventsource/eventsource-stream.js`, where the `maxEventSize` limit is only enforced inside `parseLine()`, which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a `data:` field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22069",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109924"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-4qv8-2p9j-2685"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:59.691676Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:39.827000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:59.844509Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.485058Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21185768",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hanityx"
],
"semver": {
"vulnerable": [
">=6.23.0 <6.29.1",
">=7.18.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:25.657338Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T12:13:09.757051Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T12:13:09.757051Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:25.657338Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via excessive `Content-Encoding` headers in an HTTP response processed by `httpNetworkFetch` in `lib/web/fetch/index.js`. A server returning a response with more than five content-encoding layers triggers an error path that previously called `reject()` before the response body `Readable` stream was initialised, leaving the stream in an inconsistent state and crashing the client process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.26283",
"probability": "0.00343",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109869"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-xjj6-f33q-929c"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T12:13:09.273080Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:36.082000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T12:13:09.432573Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T12:13:09.757051Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"server@1.0.0",
"@langchain/qdrant@1.0.3",
"@qdrant/js-client-rest@1.17.0",
"undici@7.29.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.29.1",
"severityWithCritical": "high"
}
],
"upgrade": {
"@modelcontextprotocol/sdk@1.29.0": {
"upgradeTo": "@modelcontextprotocol/sdk@1.31.0",
"upgrades": [
"@modelcontextprotocol/sdk@1.29.0"
],
"vulns": [
"SNYK-JS-MODELCONTEXTPROTOCOLSDK-20579853"
]
},
"axios@1.18.1": {
"upgradeTo": "axios@1.20.0",
"upgrades": [
"axios@1.18.1",
"axios@1.18.1",
"axios@1.18.1",
"axios@1.18.1",
"axios@1.18.1",
"axios@1.18.1",
"axios@1.18.1",
"axios@1.18.1"
],
"vulns": [
"SNYK-JS-AXIOS-20245042",
"SNYK-JS-AXIOS-20245044",
"SNYK-JS-AXIOS-20245046",
"SNYK-JS-AXIOS-20245048",
"SNYK-JS-AXIOS-20245056",
"SNYK-JS-AXIOS-20245060",
"SNYK-JS-AXIOS-20245062",
"SNYK-JS-AXIOS-20245066"
]
},
"eslint@8.48.0": {
"upgradeTo": "eslint@10.0.0",
"upgrades": [
"brace-expansion@1.1.18",
"brace-expansion@1.1.18",
"js-yaml@4.3.1",
"uri-js@4.4.1"
],
"vulns": [
"SNYK-JS-BRACEEXPANSION-20244948",
"SNYK-JS-BRACEEXPANSION-20244952",
"SNYK-JS-JSYAML-19496768",
"SNYK-JS-URIJS-19963963"
]
},
"mammoth@1.12.0": {
"upgradeTo": "mammoth@1.12.3",
"upgrades": [
"mammoth@1.12.0",
"mammoth@1.12.0"
],
"vulns": [
"SNYK-JS-MAMMOTH-20510281",
"SNYK-JS-MAMMOTH-20074633"
]
},
"sharp@0.35.4": {
"upgradeTo": "sharp@0.35.5",
"upgrades": [
"sharp@0.35.4"
],
"vulns": [
"SNYK-JS-SHARP-20552492"
]
},
"zod@3.25.76": {
"upgradeTo": "zod@4.6.6",
"upgrades": [
"zod@3.25.76"
],
"vulns": [
"SNYK-JS-ZOD-20510278"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 37,
"targetFile": "/opt/scopear/app/services/ai-server/package.json",
"projectName": "server",
"displayTargetFile": "/opt/scopear/app/services/ai-server/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-ai-server:2.51.7_71819fb.4373"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 1,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/opt/scopear/app/node_modules",
"projectName": "app",
"displayTargetFile": "/opt/scopear/app/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-ai-server:2.51.7_71819fb.4373"
},
{
"vulnerabilities": [
{
"id": "SNYK-JS-AXIOS-20245042",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"groot"
],
"semver": {
"vulnerable": [
">=1.16.1 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:23.137183Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:38:12.806890Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:38:12.806890Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:23.137183Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via improper validation of runtime options in `resolveConfig` and related helpers, where an attacker-controlled or malformed configuration value can trigger a crash in the request processing pipeline. The hardening of option handling across `fetch.js`, `http.js`, `dispatchRequest.js`, and supporting helpers indicates that unsanitized option objects could be passed through to the underlying fetch or HTTP adapter in a way that causes an unhandled runtime error, crashing the process and denying service to other users.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r)\n",
"epssDetails": {
"percentile": "0.29698",
"probability": "0.00382",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101903"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c29m-xwm3-cm6r"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:43:27.441172Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:24Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:43:27.601734Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:38:12.806890Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245044",
"title": "Improper Validation of Specified Quantity in Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"RelunSec"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:38:20.852962Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:38:20.852962Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization or allowlist enforcement. An attacker who can influence request configuration can supply option values that override Axios-owned fields (such as `signal`, `method`, `headers`, or `body`) or inject unexpected fetch option keys, causing the request pipeline to crash and producing a denial of service.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8)\n",
"epssDetails": {
"percentile": "0.29838",
"probability": "0.00384",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101901"
],
"CWE": [
"CWE-1284"
],
"GHSA": [
"GHSA-542g-h47m-68v8"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:49:45.410625Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:43Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:49:45.572984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:38:20.852962Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245046",
"title": "Improper Validation of Specified Quantity in Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"RelunSec"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:39.672628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:39.672628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization or allowlist enforcement. An attacker who can influence request configuration can supply option values that override Axios-owned fields (such as `signal`, `method`, `headers`, or `body`) or inject unexpected fetch option keys, causing the request pipeline to crash and producing a denial of service.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8)\n",
"epssDetails": {
"percentile": "0.29838",
"probability": "0.00384",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101901"
],
"CWE": [
"CWE-1284"
],
"GHSA": [
"GHSA-542g-h47m-68v8"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:55:07.211008Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:43Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:55:07.384339Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:39.672628Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245048",
"title": "Unintended Proxy or Intermediary ('Confused Deputy')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"credit": [
"David Carliez"
],
"semver": {
"vulnerable": [
">=1.15.2 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-29T05:42:56.881452Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.6,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:48.255859Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:48.255859Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:56.881452Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via insufficient hardening of runtime option handling in the fetch and HTTP adapters (`lib/adapters/fetch.js`, `lib/adapters/http.js`, and related helpers). An authenticated attacker can supply malicious request options that are passed through without sanitization, allowing them to override Axios-controlled fetch properties such as `body`, `headers`, `method`, `signal`, `duplex`, and `credentials`, leading to a full compromise of request confidentiality and integrity.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3)\n",
"epssDetails": {
"percentile": "0.19290",
"probability": "0.00289",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101905"
],
"CWE": [
"CWE-441"
],
"GHSA": [
"GHSA-m8m8-qj5v-23w3"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:55:52.908103Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:23Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:55:53.121095Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:48.255859Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245056",
"title": "Unintended Proxy or Intermediary ('Confused Deputy')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"credit": [
"McDubh"
],
"semver": {
"vulnerable": [
">=1.17.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-29T05:42:50.608977Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:09.975186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:09.975186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:50.608977Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via improper enforcement of `maxRedirects: 0` in the fetch adapter, where user-supplied `fetchOptions` are merged into the resolved request options without defaulting the `redirect` field. When a caller sets `maxRedirects: 0` to prevent redirects, the fetch adapter does not apply `redirect: 'manual'` unless the caller also explicitly sets `fetchOptions.redirect`, causing the underlying fetch runtime to silently follow a `302` redirect from the initial target and forward the request - including any credentials or sensitive headers - to the redirect destination, which may be attacker-controlled.\r\n\r\n**Note:** This is only exploitable when requests are configured with `maxRedirects: 0` but without `fetchOptions.redirect: 'manual'` or an equivalent runtime-specific redirect control.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh)\n",
"epssDetails": {
"percentile": "0.33172",
"probability": "0.00414",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101907"
],
"CWE": [
"CWE-441"
],
"GHSA": [
"GHSA-r4gj-5m52-g5wh"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:02:07.482079Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T19:32:38Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:02:07.647927Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:09.975186Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245060",
"title": "Server-side Request Forgery (SSRF)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"credit": [
"HamdaanAliQuatil"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.8,
"modificationTime": "2026-09-29T05:42:44.788930Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:27.159529Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:27.159529Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:44.788930Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via unsafe merging of user-supplied `fetchOptions` into the resolved request options object in `lib/adapters/fetch.js`. An attacker who controls request configuration can supply a `fetchOptions` object with prototype-polluting keys (e.g. `__proto__` or `constructor`), which are spread directly into the options passed to the Fetch API without sanitization, allowing pollution of `Object.prototype` and affecting downstream system-level behaviour. The fix replaces the spread with `Object.assign(Object.create(null), fetchOptions)` to strip inherited properties and enforces an allowlist of safe Fetch API keys.\r\n\r\n**Note:** This is only exploitable when the attacker can influence the `fetchOptions` configuration passed to axios requests.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v)\n",
"epssDetails": {
"percentile": "0.42391",
"probability": "0.00527",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101898"
],
"CWE": [
"CWE-918"
],
"GHSA": [
"GHSA-3pq3-5fj3-cg6v"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:08:29.503613Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:40Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:08:29.828583Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:27.159529Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245062",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"zaneins"
],
"semver": {
"vulnerable": [
">=1.15.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:43:00.363038Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:35.786750Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:35.786750Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:43:00.363038Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization. An attacker who can influence request configuration can trigger uncontrolled resource consumption, crashing the process.\r\n\r\n**Note:** This is only exploitable when requests follow redirects (i.e., `maxRedirects` is not set to `0`), unless application code manually follows the malicious redirect and re-enters axios.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj)\n",
"epssDetails": {
"percentile": "0.31831",
"probability": "0.00402",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101906"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mghh-pgcx-3jjj"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:09:30.186140Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:27Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:09:30.380901Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:35.786750Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245066",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P",
"credit": [
"Barnabas Charumbuka"
],
"semver": {
"vulnerable": [
">=0.28.0 <0.34.0",
">=1.15.1 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.34.0",
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-29T05:42:48.026289Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:13.180160Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:13.180160Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:48.026289Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling across multiple request-processing helpers (`lib/helpers/resolveConfig.js`, `lib/helpers/toFormData.js`, `lib/adapters/fetch.js`, and related files). An attacker can supply a manipulated configuration object that overrides internally owned fetch options (such as `body`, `headers`, `method`, `signal`) or bypasses the default `formSerializer.maxDepth` limit, leading to integrity violations in outgoing requests or a crash causing denial of service.\r\n\r\n**Note:** This is only exploitable when the caller does not explicitly set `formSerializer.maxDepth`, allowing a prototype-level or caller-supplied value to override the expected default.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 0.34.0, 1.20.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f)\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub Commit](https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n",
"epssDetails": {
"percentile": "0.26599",
"probability": "0.00354",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101909"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-x97p-jq2g-jp4f"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:23:19.571870Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T19:32:44Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:23:19.790565Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:13.180160Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"brace-expansion@5.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"brace-expansion@5.0.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"brace-expansion@5.0.11"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"brace-expansion@5.0.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/config-array@0.23.5",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"@eslint/config-array@0.23.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/config-array@0.23.5",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"@eslint/config-array@0.23.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/config-array@0.23.5",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"@eslint/config-array@0.23.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/config-array@0.23.5",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"@eslint/config-array@0.23.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@10.8.1",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"eslint@10.8.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@10.8.1",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"eslint@10.8.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@10.8.1",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"eslint@10.8.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@10.8.1",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"eslint@10.8.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACES-19963945",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "braces",
"references": [
{
"url": "https://github.com/micromatch/braces/issues/70",
"title": "GitHub Issue"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js%23L49-L53",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js%23L102-L105",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js%23L38-L40",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:03.538327Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:03.538327Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"description": "## Overview\n[braces](https://www.npmjs.com/package/braces) is a Bash-like brace expansion, implemented in JavaScript.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught `RangeError`.\n## Remediation\nThere is no fixed version for `braces`.\n## References\n- [GitHub Issue](https://github.com/micromatch/braces/issues/70)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40)\n",
"epssDetails": {
"percentile": "0.53919",
"probability": "0.00757",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93687"
],
"CWE": [
"CWE-674"
]
},
"packageName": "braces",
"proprietary": false,
"creationTime": "2026-09-20T07:45:12.687490Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:24Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T07:45:12.861805Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:03.538327Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/jest@29.5.14",
"expect@29.7.0",
"jest-message-util@29.7.0",
"micromatch@4.0.8",
"braces@3.0.3"
],
"upgradePath": [
false,
"@types/jest@30.0.0",
"expect@30.5.2",
"jest-message-util@30.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "braces",
"version": "3.0.3"
},
{
"id": "SNYK-JS-EXTRACTZIP-17660777",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"credit": [
"Ziad Salah"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json",
"title": "Advisory"
},
{
"url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf",
"title": "GitHub Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:23:58.096190Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:23:58.096190Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n",
"epssDetails": {
"percentile": "0.42049",
"probability": "0.00526",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56876"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-x7jf-2287-qcpf"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-06-28T07:51:29.464799Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T18:15:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-28T07:51:29.629427Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:23:58.096190Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-EXTRACTZIP-19653641",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650",
"title": "GitHub Commit"
},
{
"url": "https://github.com/max-mapper/extract-zip/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n",
"epssDetails": {
"percentile": "0.20481",
"probability": "0.00280",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19693"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-7pqw-9j4j-h8q3"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-09-09T14:54:22.763062Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-17T15:30:40Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T14:54:23.005562Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:30.140412Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-HANDLEBARS-20557395",
"title": "Incomplete List of Disallowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Brandon T. Elliott"
],
"semver": {
"vulnerable": [
">=4.6.0 <4.7.10"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the `lookupProperty` function in `lib/handlebars/runtime.js`, which returns the resolved value as soon as `Object.prototype.hasOwnProperty.call(parent, propertyName)` holds, without consulting the prototype access deny list, and `constructor` is an own property of every prototype object, so `Function.prototype.constructor` resolves to `Function` itself. An attacker can execute code on the server by rendering a template that walks to a prototype and reads its constructor, as in `{{lookup (lookup fn \"__proto__\") \"constructor\"}}`. This requires the attacker to control the template rather than only the data, and compilation with `allowProtoMethodsByDefault: true`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by leaving `allowProtoMethodsByDefault` at its default of false when compiling untrusted templates.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.33286",
"probability": "0.00411",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106445"
],
"CWE": [
"CWE-184"
],
"GHSA": [
"GHSA-p8wg-vrv2-v86f"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-07T12:22:11.306334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T21:16:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T12:22:11.534110Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:00.379948Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-HANDLEBARS-20574183",
"title": "Access of Resource Using Incompatible Type ('Type Confusion')",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Nick Mykhailyshyn",
"bhaswanthc",
"Lương Nguyễn Ngọc Đình",
"jmoritzc53",
"n0tra4e",
"hibrian827",
"Thai Son Dinh",
"Nikola Kojic",
"Ahmed Elmahgob",
"vk-can",
"PellaML",
"shenhuanageshei",
"kagebunsher",
"kustundag",
"ffasterss",
"sanmatte"
],
"semver": {
"vulnerable": [
">=4.0.0 <4.7.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the compiler's handling of pre-parsed AST objects passed to `compile` or `precompile`. When a caller supplies a hand-built or attacker-influenced AST directly to the compiler, AST node values such as path depths, path parts, literal values, content strings, hash pair keys, and block params are written into generated JavaScript code without sufficient validation, allowing an attacker to inject arbitrary code into the compiled template output. The fix moves all AST value validation into the compiler itself, so that values are checked at the point they are written into generated code rather than only at parse time.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.49055",
"probability": "0.00640",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106446"
],
"CWE": [
"CWE-843",
"CWE-94"
],
"GHSA": [
"GHSA-8r5x-fm3f-whwj"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-08T21:01:07.219662Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-08T17:52:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-08T21:01:07.443371Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:04.407777Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-HANDLEBARS-20557395",
"title": "Incomplete List of Disallowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Brandon T. Elliott"
],
"semver": {
"vulnerable": [
">=4.6.0 <4.7.10"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the `lookupProperty` function in `lib/handlebars/runtime.js`, which returns the resolved value as soon as `Object.prototype.hasOwnProperty.call(parent, propertyName)` holds, without consulting the prototype access deny list, and `constructor` is an own property of every prototype object, so `Function.prototype.constructor` resolves to `Function` itself. An attacker can execute code on the server by rendering a template that walks to a prototype and reads its constructor, as in `{{lookup (lookup fn \"__proto__\") \"constructor\"}}`. This requires the attacker to control the template rather than only the data, and compilation with `allowProtoMethodsByDefault: true`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by leaving `allowProtoMethodsByDefault` at its default of false when compiling untrusted templates.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.33286",
"probability": "0.00411",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106445"
],
"CWE": [
"CWE-184"
],
"GHSA": [
"GHSA-p8wg-vrv2-v86f"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-07T12:22:11.306334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T21:16:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T12:22:11.534110Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:00.379948Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"ts-jest@29.4.12",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"ts-jest@29.4.12",
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-HANDLEBARS-20574183",
"title": "Access of Resource Using Incompatible Type ('Type Confusion')",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Nick Mykhailyshyn",
"bhaswanthc",
"Lương Nguyễn Ngọc Đình",
"jmoritzc53",
"n0tra4e",
"hibrian827",
"Thai Son Dinh",
"Nikola Kojic",
"Ahmed Elmahgob",
"vk-can",
"PellaML",
"shenhuanageshei",
"kagebunsher",
"kustundag",
"ffasterss",
"sanmatte"
],
"semver": {
"vulnerable": [
">=4.0.0 <4.7.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the compiler's handling of pre-parsed AST objects passed to `compile` or `precompile`. When a caller supplies a hand-built or attacker-influenced AST directly to the compiler, AST node values such as path depths, path parts, literal values, content strings, hash pair keys, and block params are written into generated JavaScript code without sufficient validation, allowing an attacker to inject arbitrary code into the compiled template output. The fix moves all AST value validation into the compiler itself, so that values are checked at the point they are written into generated code rather than only at parse time.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.49055",
"probability": "0.00640",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106446"
],
"CWE": [
"CWE-843",
"CWE-94"
],
"GHSA": [
"GHSA-8r5x-fm3f-whwj"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-08T21:01:07.219662Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-08T17:52:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-08T21:01:07.443371Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:04.407777Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"ts-jest@29.4.12",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"ts-jest@29.4.12",
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<