{
"vulnerabilities": [
{
"id": "SNYK-UBUNTU2204-NODEJS-17268893",
"cpes": [],
"title": "CVE-2026-45447",
"CVSSv3": null,
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": null,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447"
},
{
"url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt",
"title": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25237",
"title": "https://access.redhat.com/errata/RHSA-2026:25237"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239",
"title": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26275",
"title": "https://access.redhat.com/errata/RHSA-2026:26275"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26319",
"title": "https://access.redhat.com/errata/RHSA-2026:26319"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:29197",
"title": "https://access.redhat.com/errata/RHSA-2026:29197"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34102",
"title": "https://access.redhat.com/errata/RHSA-2026:34102"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35869",
"title": "https://access.redhat.com/errata/RHSA-2026:35869"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36215",
"title": "https://access.redhat.com/errata/RHSA-2026:36215"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36217",
"title": "https://access.redhat.com/errata/RHSA-2026:36217"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39009",
"title": "https://access.redhat.com/errata/RHSA-2026:39009"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39012",
"title": "https://access.redhat.com/errata/RHSA-2026:39012"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39981",
"title": "https://access.redhat.com/errata/RHSA-2026:39981"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45447",
"title": "https://access.redhat.com/security/cve/CVE-2026-45447"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json",
"title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:44438",
"title": "https://access.redhat.com/errata/RHSA-2026:44438"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47735",
"title": "https://access.redhat.com/errata/RHSA-2026:47735"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47737",
"title": "https://access.redhat.com/errata/RHSA-2026:47737"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58563",
"title": "https://access.redhat.com/errata/RHSA-2026:58563"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58981",
"title": "https://access.redhat.com/errata/RHSA-2026:58981"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59831",
"title": "https://access.redhat.com/errata/RHSA-2026:59831"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:66524",
"title": "https://access.redhat.com/errata/RHSA-2026:66524"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"cvssSources": [
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n",
"epssDetails": {
"percentile": "0.90162",
"probability": "0.04002",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-45447"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": null,
"packageName": "nodejs",
"creationTime": "2026-06-10T02:46:34.655313Z",
"disclosureTime": "2026-06-09T17:17:19.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-06-10T02:46:34.660471Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-09-25T21:42:07.304624Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-wlc2-mc@2.51.7_71819fb.4373",
"nodejs@22.23.3-1nodesource1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "nodejs",
"version": "22.23.3-1nodesource1"
},
{
"id": "SNYK-UBUNTU2204-NODEJS-20266986",
"cpes": [],
"title": "CVE-2026-84782",
"CVSSv3": null,
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": null,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782"
},
{
"url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943",
"title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943"
},
{
"url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628",
"title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628"
},
{
"url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58",
"title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58"
},
{
"url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c",
"title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c"
},
{
"url": "https://openssl-library.org/news/secadv/20260929.txt",
"title": "https://openssl-library.org/news/secadv/20260929.txt"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-30T05:53:20.212801Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-03T11:01:35.528611Z"
}
],
"cvssSources": [
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:53:20.212801Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-03T11:01:35.528611Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n",
"epssDetails": {
"percentile": "0.30690",
"probability": "0.00390",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84782"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": null,
"packageName": "nodejs",
"creationTime": "2026-09-30T03:05:00.936532Z",
"disclosureTime": "2026-09-29T16:17:12.500000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-09-30T03:05:00.939158Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-10-03T11:01:36.139633Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-wlc2-mc@2.51.7_71819fb.4373",
"nodejs@22.23.3-1nodesource1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "nodejs",
"version": "22.23.3-1nodesource1"
}
],
"ok": false,
"dependencyCount": 567,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "deb",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {
"binariesVulns": {
"issuesData": {},
"affectedPkgs": {}
},
"os": {
"prettyName": "Ubuntu 22.04.5 LTS"
}
},
"summary": "2 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 2,
"projectName": "docker-image|docker.io/scopear/docker-wlc2-mc",
"platform": "linux/amd64",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-mc:2.51.7_71819fb.4373/scopear/docker-wlc2-mc",
"applications": [
{
"vulnerabilities": [
{
"id": "SNYK-JS-SHARP-20552492",
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P",
"credit": [
"Rafael B. Dias"
],
"semver": {
"vulnerable": [
"<0.35.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.35.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236",
"title": "GitHub Commit"
},
{
"url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241",
"title": "GitLab Work Item"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279",
"title": "Red Hat Bugzilla Bug"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html",
"title": "RustSec Advisory"
},
{
"url": "https://github.com/rafabd1/VectorFreed",
"title": "PoC in GitHub"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-24T01:31:00.638194Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-24T05:38:15.426615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-10-12T14:04:41.725598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-12T14:04:41.725598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T01:31:00.638194Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:15.426615Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Use After Free in `entity_insert()` and the entity map held on `XmlState`, which is shared between the outer parse and a recursive XInclude, so inserting an entity whose name already exists replaces the first entry and its `Drop` implementation calls `xmlFreeNode()` while the outer `xmlCtxtParseEntity()` is still using that 144 byte `xmlEntity`. An attacker can corrupt process memory by supplying an SVG document whose `xi:include` pulls in another document redefining an entity that is already active. This requires the application to parse attacker supplied SVG with XInclude processing reached, and the entity names must collide across the outer document and the included one.\n## Remediation\nUpgrade `sharp` to version 0.35.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w)\n- [GitHub Commit](https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236)\n- [GitLab Work Item](https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2539279)\n- [RustSec Advisory](https://rustsec.org/advisories/RUSTSEC-2026-0305.html)\n- [PoC in GitHub](https://github.com/rafabd1/VectorFreed)\n",
"epssDetails": {
"percentile": "0.03774",
"probability": "0.00151",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-96889"
],
"CWE": [
"CWE-416"
],
"GHSA": [
"GHSA-wq5f-xc86-pv6w"
],
"RUSTSEC": [
"RUSTSEC-2026-0305"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-10-07T08:26:39.430160Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-23T12:00:00Z",
"exploitDetails": {
"sources": [
"PoC in GitHub"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T08:26:39.631665Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-12T14:04:41.725598Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-model-converter@1.0.0",
"sharp@0.35.4"
],
"upgradePath": [
false,
"sharp@0.35.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "sharp",
"version": "0.35.4"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-model-converter@1.0.0",
"puppeteer@25.6.0",
"chromium-bidi@17.0.2",
"zod@3.25.76"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-model-converter@1.0.0",
"puppeteer@25.6.0",
"puppeteer-core@25.6.0",
"chromium-bidi@17.0.2",
"zod@3.25.76"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
}
],
"ok": false,
"dependencyCount": 77,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "3 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"worklink-create-model-converter@1.0.0",
"puppeteer@25.6.0",
"puppeteer-core@25.6.0",
"chromium-bidi@17.0.2",
"zod@3.25.76"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "zod",
"version": "3.25.76",
"severityWithCritical": "high"
}
],
"upgrade": {
"sharp@0.35.4": {
"upgradeTo": "sharp@0.35.5",
"upgrades": [
"sharp@0.35.4"
],
"vulns": [
"SNYK-JS-SHARP-20552492"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 2,
"targetFile": "/opt/scopear/app/services/model-converter/package.json",
"projectName": "worklink-create-model-converter",
"displayTargetFile": "/opt/scopear/app/services/model-converter/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-mc:2.51.7_71819fb.4373"
},
{
"vulnerabilities": [
{
"id": "SNYK-JS-EXTRACTZIP-17660777",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"credit": [
"Ziad Salah"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json",
"title": "Advisory"
},
{
"url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf",
"title": "GitHub Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:23:58.096190Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:23:58.096190Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n",
"epssDetails": {
"percentile": "0.42049",
"probability": "0.00526",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56876"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-x7jf-2287-qcpf"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-06-28T07:51:29.464799Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T18:15:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-28T07:51:29.629427Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:23:58.096190Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-services@1.0.0",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-EXTRACTZIP-19653641",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650",
"title": "GitHub Commit"
},
{
"url": "https://github.com/max-mapper/extract-zip/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n",
"epssDetails": {
"percentile": "0.20481",
"probability": "0.00280",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19693"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-7pqw-9j4j-h8q3"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-09-09T14:54:22.763062Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-17T15:30:40Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T14:54:23.005562Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:30.140412Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-services@1.0.0",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-services@1.0.0",
"express@5.2.1",
"qs@6.16.0"
],
"upgradePath": [
false,
"express@5.2.1",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.16.0"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-services@1.0.0",
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.0"
],
"upgradePath": [
false,
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.16.0"
},
{
"id": "SNYK-JS-SHARP-19653587",
"title": "Heap-based Buffer Overflow",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<0.35.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.35.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/releases/tag/v0.35.4",
"title": "GitHub Release"
},
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:39.720123Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:39.720123Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Heap-based Buffer Overflow in the `VipsForeignLoadHeif` process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input. \r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: [\"VipsForeignLoadHeif\"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).\n## Remediation\nUpgrade `sharp` to version 0.35.4 or higher.\n## References\n- [GitHub Release](https://github.com/lovell/sharp/releases/tag/v0.35.4)\n- [Maintainer's Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-122"
],
"GHSA": [
"GHSA-rgj7-g3m4-5g8c"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-09-09T13:56:44.366968Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-08T21:25:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T13:56:44.573106Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:39.720123Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-services@1.0.0",
"@gltf-transform/functions@4.4.2",
"ndarray-pixels@5.0.1",
"sharp@0.35.3"
],
"upgradePath": [
false,
"@gltf-transform/functions@4.4.2",
"ndarray-pixels@5.2.0",
"sharp@0.35.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "sharp",
"version": "0.35.3"
},
{
"id": "SNYK-JS-SHARP-20552492",
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P",
"credit": [
"Rafael B. Dias"
],
"semver": {
"vulnerable": [
"<0.35.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.35.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236",
"title": "GitHub Commit"
},
{
"url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241",
"title": "GitLab Work Item"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279",
"title": "Red Hat Bugzilla Bug"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html",
"title": "RustSec Advisory"
},
{
"url": "https://github.com/rafabd1/VectorFreed",
"title": "PoC in GitHub"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-24T01:31:00.638194Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-24T05:38:15.426615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-10-12T14:04:41.725598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-12T14:04:41.725598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T01:31:00.638194Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:15.426615Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Use After Free in `entity_insert()` and the entity map held on `XmlState`, which is shared between the outer parse and a recursive XInclude, so inserting an entity whose name already exists replaces the first entry and its `Drop` implementation calls `xmlFreeNode()` while the outer `xmlCtxtParseEntity()` is still using that 144 byte `xmlEntity`. An attacker can corrupt process memory by supplying an SVG document whose `xi:include` pulls in another document redefining an entity that is already active. This requires the application to parse attacker supplied SVG with XInclude processing reached, and the entity names must collide across the outer document and the included one.\n## Remediation\nUpgrade `sharp` to version 0.35.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w)\n- [GitHub Commit](https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236)\n- [GitLab Work Item](https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2539279)\n- [RustSec Advisory](https://rustsec.org/advisories/RUSTSEC-2026-0305.html)\n- [PoC in GitHub](https://github.com/rafabd1/VectorFreed)\n",
"epssDetails": {
"percentile": "0.03774",
"probability": "0.00151",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-96889"
],
"CWE": [
"CWE-416"
],
"GHSA": [
"GHSA-wq5f-xc86-pv6w"
],
"RUSTSEC": [
"RUSTSEC-2026-0305"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-10-07T08:26:39.430160Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-23T12:00:00Z",
"exploitDetails": {
"sources": [
"PoC in GitHub"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T08:26:39.631665Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-12T14:04:41.725598Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-services@1.0.0",
"@gltf-transform/functions@4.4.2",
"ndarray-pixels@5.0.1",
"sharp@0.35.3"
],
"upgradePath": [
false,
"@gltf-transform/functions@4.4.2",
"ndarray-pixels@5.2.0",
"sharp@0.35.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "sharp",
"version": "0.35.3"
}
],
"ok": false,
"dependencyCount": 303,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "6 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-EXTRACTZIP-17660777",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"credit": [
"Ziad Salah"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json",
"title": "Advisory"
},
{
"url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf",
"title": "GitHub Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:23:58.096190Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:23:58.096190Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n",
"epssDetails": {
"percentile": "0.42049",
"probability": "0.00526",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56876"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-x7jf-2287-qcpf"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-06-28T07:51:29.464799Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T18:15:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-28T07:51:29.629427Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:23:58.096190Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"worklink-create-services@1.0.0",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "extract-zip",
"version": "2.0.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-EXTRACTZIP-19653641",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650",
"title": "GitHub Commit"
},
{
"url": "https://github.com/max-mapper/extract-zip/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n",
"epssDetails": {
"percentile": "0.20481",
"probability": "0.00280",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19693"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-7pqw-9j4j-h8q3"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-09-09T14:54:22.763062Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-17T15:30:40Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T14:54:23.005562Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:30.140412Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"worklink-create-services@1.0.0",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "extract-zip",
"version": "2.0.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"worklink-create-services@1.0.0",
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.0"
],
"upgradePath": [
false,
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "qs",
"version": "6.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-SHARP-19653587",
"title": "Heap-based Buffer Overflow",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<0.35.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.35.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/releases/tag/v0.35.4",
"title": "GitHub Release"
},
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:39.720123Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:39.720123Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Heap-based Buffer Overflow in the `VipsForeignLoadHeif` process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input. \r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: [\"VipsForeignLoadHeif\"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).\n## Remediation\nUpgrade `sharp` to version 0.35.4 or higher.\n## References\n- [GitHub Release](https://github.com/lovell/sharp/releases/tag/v0.35.4)\n- [Maintainer's Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-122"
],
"GHSA": [
"GHSA-rgj7-g3m4-5g8c"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-09-09T13:56:44.366968Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-08T21:25:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T13:56:44.573106Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:39.720123Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"worklink-create-services@1.0.0",
"@gltf-transform/functions@4.4.2",
"ndarray-pixels@5.0.1",
"sharp@0.35.3"
],
"upgradePath": [
false,
"@gltf-transform/functions@4.4.2",
"ndarray-pixels@5.2.0",
"sharp@0.35.5"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "sharp",
"version": "0.35.3",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-SHARP-20552492",
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P",
"credit": [
"Rafael B. Dias"
],
"semver": {
"vulnerable": [
"<0.35.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.35.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236",
"title": "GitHub Commit"
},
{
"url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241",
"title": "GitLab Work Item"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279",
"title": "Red Hat Bugzilla Bug"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html",
"title": "RustSec Advisory"
},
{
"url": "https://github.com/rafabd1/VectorFreed",
"title": "PoC in GitHub"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-24T01:31:00.638194Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-24T05:38:15.426615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-10-12T14:04:41.725598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-12T14:04:41.725598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T01:31:00.638194Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:15.426615Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Use After Free in `entity_insert()` and the entity map held on `XmlState`, which is shared between the outer parse and a recursive XInclude, so inserting an entity whose name already exists replaces the first entry and its `Drop` implementation calls `xmlFreeNode()` while the outer `xmlCtxtParseEntity()` is still using that 144 byte `xmlEntity`. An attacker can corrupt process memory by supplying an SVG document whose `xi:include` pulls in another document redefining an entity that is already active. This requires the application to parse attacker supplied SVG with XInclude processing reached, and the entity names must collide across the outer document and the included one.\n## Remediation\nUpgrade `sharp` to version 0.35.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w)\n- [GitHub Commit](https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236)\n- [GitLab Work Item](https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2539279)\n- [RustSec Advisory](https://rustsec.org/advisories/RUSTSEC-2026-0305.html)\n- [PoC in GitHub](https://github.com/rafabd1/VectorFreed)\n",
"epssDetails": {
"percentile": "0.03774",
"probability": "0.00151",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-96889"
],
"CWE": [
"CWE-416"
],
"GHSA": [
"GHSA-wq5f-xc86-pv6w"
],
"RUSTSEC": [
"RUSTSEC-2026-0305"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-10-07T08:26:39.430160Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-23T12:00:00Z",
"exploitDetails": {
"sources": [
"PoC in GitHub"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T08:26:39.631665Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-12T14:04:41.725598Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"worklink-create-services@1.0.0",
"@gltf-transform/functions@4.4.2",
"ndarray-pixels@5.0.1",
"sharp@0.35.3"
],
"upgradePath": [
false,
"@gltf-transform/functions@4.4.2",
"ndarray-pixels@5.2.0",
"sharp@0.35.5"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "sharp",
"version": "0.35.3",
"severityWithCritical": "high"
}
],
"upgrade": {},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 5,
"targetFile": "/opt/scopear/app/services/package.json",
"projectName": "worklink-create-services",
"displayTargetFile": "/opt/scopear/app/services/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-mc:2.51.7_71819fb.4373"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 0,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/opt/scopear/app/package.json",
"projectName": "worklink-create-2",
"displayTargetFile": "/opt/scopear/app/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-mc:2.51.7_71819fb.4373"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 2,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/opt/scopear/app/common/package.json",
"projectName": "package.json",
"displayTargetFile": "/opt/scopear/app/common/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-mc:2.51.7_71819fb.4373"
},
{
"vulnerabilities": [
{
"id": "SNYK-JS-AXIOS-20245042",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"groot"
],
"semver": {
"vulnerable": [
">=1.16.1 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:23.137183Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:38:12.806890Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:38:12.806890Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:23.137183Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via improper validation of runtime options in `resolveConfig` and related helpers, where an attacker-controlled or malformed configuration value can trigger a crash in the request processing pipeline. The hardening of option handling across `fetch.js`, `http.js`, `dispatchRequest.js`, and supporting helpers indicates that unsanitized option objects could be passed through to the underlying fetch or HTTP adapter in a way that causes an unhandled runtime error, crashing the process and denying service to other users.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r)\n",
"epssDetails": {
"percentile": "0.29698",
"probability": "0.00382",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101903"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c29m-xwm3-cm6r"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:43:27.441172Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:24Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:43:27.601734Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:38:12.806890Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"axios@1.19.0"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.19.0"
},
{
"id": "SNYK-JS-AXIOS-20245044",
"title": "Improper Validation of Specified Quantity in Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"RelunSec"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:38:20.852962Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:38:20.852962Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization or allowlist enforcement. An attacker who can influence request configuration can supply option values that override Axios-owned fields (such as `signal`, `method`, `headers`, or `body`) or inject unexpected fetch option keys, causing the request pipeline to crash and producing a denial of service.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8)\n",
"epssDetails": {
"percentile": "0.29838",
"probability": "0.00384",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101901"
],
"CWE": [
"CWE-1284"
],
"GHSA": [
"GHSA-542g-h47m-68v8"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:49:45.410625Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:43Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:49:45.572984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:38:20.852962Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"axios@1.19.0"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.19.0"
},
{
"id": "SNYK-JS-AXIOS-20245046",
"title": "Improper Validation of Specified Quantity in Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"RelunSec"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:39.672628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:39.672628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization or allowlist enforcement. An attacker who can influence request configuration can supply option values that override Axios-owned fields (such as `signal`, `method`, `headers`, or `body`) or inject unexpected fetch option keys, causing the request pipeline to crash and producing a denial of service.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8)\n",
"epssDetails": {
"percentile": "0.29838",
"probability": "0.00384",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101901"
],
"CWE": [
"CWE-1284"
],
"GHSA": [
"GHSA-542g-h47m-68v8"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:55:07.211008Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:43Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:55:07.384339Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:39.672628Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"axios@1.19.0"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.19.0"
},
{
"id": "SNYK-JS-AXIOS-20245048",
"title": "Unintended Proxy or Intermediary ('Confused Deputy')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"credit": [
"David Carliez"
],
"semver": {
"vulnerable": [
">=1.15.2 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-29T05:42:56.881452Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.6,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:48.255859Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:48.255859Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:56.881452Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via insufficient hardening of runtime option handling in the fetch and HTTP adapters (`lib/adapters/fetch.js`, `lib/adapters/http.js`, and related helpers). An authenticated attacker can supply malicious request options that are passed through without sanitization, allowing them to override Axios-controlled fetch properties such as `body`, `headers`, `method`, `signal`, `duplex`, and `credentials`, leading to a full compromise of request confidentiality and integrity.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3)\n",
"epssDetails": {
"percentile": "0.19290",
"probability": "0.00289",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101905"
],
"CWE": [
"CWE-441"
],
"GHSA": [
"GHSA-m8m8-qj5v-23w3"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:55:52.908103Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:23Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:55:53.121095Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:48.255859Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"axios@1.19.0"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.19.0"
},
{
"id": "SNYK-JS-AXIOS-20245056",
"title": "Unintended Proxy or Intermediary ('Confused Deputy')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"credit": [
"McDubh"
],
"semver": {
"vulnerable": [
">=1.17.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-29T05:42:50.608977Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:09.975186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:09.975186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:50.608977Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via improper enforcement of `maxRedirects: 0` in the fetch adapter, where user-supplied `fetchOptions` are merged into the resolved request options without defaulting the `redirect` field. When a caller sets `maxRedirects: 0` to prevent redirects, the fetch adapter does not apply `redirect: 'manual'` unless the caller also explicitly sets `fetchOptions.redirect`, causing the underlying fetch runtime to silently follow a `302` redirect from the initial target and forward the request - including any credentials or sensitive headers - to the redirect destination, which may be attacker-controlled.\r\n\r\n**Note:** This is only exploitable when requests are configured with `maxRedirects: 0` but without `fetchOptions.redirect: 'manual'` or an equivalent runtime-specific redirect control.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh)\n",
"epssDetails": {
"percentile": "0.33172",
"probability": "0.00414",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101907"
],
"CWE": [
"CWE-441"
],
"GHSA": [
"GHSA-r4gj-5m52-g5wh"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:02:07.482079Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T19:32:38Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:02:07.647927Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:09.975186Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"axios@1.19.0"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.19.0"
},
{
"id": "SNYK-JS-AXIOS-20245060",
"title": "Server-side Request Forgery (SSRF)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"credit": [
"HamdaanAliQuatil"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.8,
"modificationTime": "2026-09-29T05:42:44.788930Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:27.159529Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:27.159529Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:44.788930Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via unsafe merging of user-supplied `fetchOptions` into the resolved request options object in `lib/adapters/fetch.js`. An attacker who controls request configuration can supply a `fetchOptions` object with prototype-polluting keys (e.g. `__proto__` or `constructor`), which are spread directly into the options passed to the Fetch API without sanitization, allowing pollution of `Object.prototype` and affecting downstream system-level behaviour. The fix replaces the spread with `Object.assign(Object.create(null), fetchOptions)` to strip inherited properties and enforces an allowlist of safe Fetch API keys.\r\n\r\n**Note:** This is only exploitable when the attacker can influence the `fetchOptions` configuration passed to axios requests.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v)\n",
"epssDetails": {
"percentile": "0.42391",
"probability": "0.00527",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101898"
],
"CWE": [
"CWE-918"
],
"GHSA": [
"GHSA-3pq3-5fj3-cg6v"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:08:29.503613Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:40Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:08:29.828583Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:27.159529Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"axios@1.19.0"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.19.0"
},
{
"id": "SNYK-JS-AXIOS-20245062",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"zaneins"
],
"semver": {
"vulnerable": [
">=1.15.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:43:00.363038Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:35.786750Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:35.786750Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:43:00.363038Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization. An attacker who can influence request configuration can trigger uncontrolled resource consumption, crashing the process.\r\n\r\n**Note:** This is only exploitable when requests follow redirects (i.e., `maxRedirects` is not set to `0`), unless application code manually follows the malicious redirect and re-enters axios.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj)\n",
"epssDetails": {
"percentile": "0.31831",
"probability": "0.00402",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101906"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mghh-pgcx-3jjj"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:09:30.186140Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:27Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:09:30.380901Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:35.786750Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"axios@1.19.0"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.19.0"
},
{
"id": "SNYK-JS-AXIOS-20245066",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P",
"credit": [
"Barnabas Charumbuka"
],
"semver": {
"vulnerable": [
">=0.28.0 <0.34.0",
">=1.15.1 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.34.0",
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-29T05:42:48.026289Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:13.180160Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:13.180160Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:48.026289Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling across multiple request-processing helpers (`lib/helpers/resolveConfig.js`, `lib/helpers/toFormData.js`, `lib/adapters/fetch.js`, and related files). An attacker can supply a manipulated configuration object that overrides internally owned fetch options (such as `body`, `headers`, `method`, `signal`) or bypasses the default `formSerializer.maxDepth` limit, leading to integrity violations in outgoing requests or a crash causing denial of service.\r\n\r\n**Note:** This is only exploitable when the caller does not explicitly set `formSerializer.maxDepth`, allowing a prototype-level or caller-supplied value to override the expected default.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 0.34.0, 1.20.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f)\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub Commit](https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n",
"epssDetails": {
"percentile": "0.26599",
"probability": "0.00354",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101909"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-x97p-jq2g-jp4f"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:23:19.571870Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T19:32:44Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:23:19.790565Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:13.180160Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"axios@1.19.0"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.19.0"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"express@5.2.1",
"qs@6.16.0"
],
"upgradePath": [
false,
"express@5.2.1",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.16.0"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.0"
],
"upgradePath": [
false,
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.16.0"
}
],
"ok": false,
"dependencyCount": 157,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "10 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"worklink-create-api@1.0.0",
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.0"
],
"upgradePath": [
false,
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "qs",
"version": "6.16.0",
"severityWithCritical": "high"
}
],
"upgrade": {
"axios@1.19.0": {
"upgradeTo": "axios@1.20.0",
"upgrades": [
"axios@1.19.0",
"axios@1.19.0",
"axios@1.19.0",
"axios@1.19.0",
"axios@1.19.0",
"axios@1.19.0",
"axios@1.19.0",
"axios@1.19.0"
],
"vulns": [
"SNYK-JS-AXIOS-20245042",
"SNYK-JS-AXIOS-20245044",
"SNYK-JS-AXIOS-20245046",
"SNYK-JS-AXIOS-20245048",
"SNYK-JS-AXIOS-20245056",
"SNYK-JS-AXIOS-20245060",
"SNYK-JS-AXIOS-20245062",
"SNYK-JS-AXIOS-20245066"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 9,
"targetFile": "/opt/scopear/app/services/api/package.json",
"projectName": "worklink-create-api",
"displayTargetFile": "/opt/scopear/app/services/api/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-mc:2.51.7_71819fb.4373"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 3,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/opt/scopear/.npm-global/lib/node_modules",
"projectName": "lib",
"displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-mc:2.51.7_71819fb.4373"
},
{
"vulnerabilities": [
{
"id": "SNYK-GOLANG-STDCRYPTOTLS-18858453",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Qi Deng of Aurascape.ai"
],
"semver": {
"vulnerable": [
"<1.25.13",
">=1.26.0-0 <1.26.6",
">=1.27.0-0 <1.27.0-rc.3"
],
"hashesRange": [
"=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/crypto/tls` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6090)\n- [Go Code Review](https://go.dev/cl/804261)\n- [Go Issue](https://go.dev/issue/80528)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n",
"epssDetails": {
"percentile": "0.44650",
"probability": "0.00568",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"GO": [
"GO-2026-6090"
],
"CVE": [
"CVE-2026-56862"
],
"CWE": [
"CWE-400"
]
},
"packageName": "std/crypto/tls",
"proprietary": false,
"creationTime": "2026-08-16T13:30:25.367479Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T21:43:54Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "golang",
"publicationTime": "2026-08-16T13:30:25.586356Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T02:00:45.946419Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"github.com/microsoft/typescript-go@*",
"stdlib@1.26.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "stdlib",
"version": "1.26.4"
},
{
"id": "SNYK-GOLANG-STDENCODINGASN1-18858463",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Marwan Atia"
],
"semver": {
"vulnerable": [
"<1.25.13",
">=1.26.0-0 <1.26.6",
">=1.27.0-0 <1.27.0-rc.3"
],
"hashesRange": [
"=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.\n## Remediation\nUpgrade `std/encoding/asn1` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5972)\n- [Go Code Review](https://go.dev/cl/814980)\n- [Go Issue](https://go.dev/issue/80405)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n",
"epssDetails": {
"percentile": "0.44468",
"probability": "0.00568",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"GO": [
"GO-2026-5972"
],
"CVE": [
"CVE-2026-33818"
],
"CWE": [
"CWE-674"
]
},
"packageName": "std/encoding/asn1",
"proprietary": false,
"creationTime": "2026-08-16T13:31:49.649800Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T21:43:54Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "golang",
"publicationTime": "2026-08-16T13:31:49.810065Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T02:00:45.337609Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"github.com/microsoft/typescript-go@*",
"stdlib@1.26.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "stdlib",
"version": "1.26.4"
},
{
"id": "SNYK-GOLANG-STDENCODINGXML-18858455",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.25.13",
">=1.26.0-0 <1.26.6",
">=1.27.0-0 <1.27.0-rc.3"
],
"hashesRange": [
"=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/xml` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6088)\n- [Go Code Review](https://go.dev/cl/803320)\n- [Go Issue](https://go.dev/issue/80481)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n",
"epssDetails": {
"percentile": "0.44468",
"probability": "0.00568",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"GO": [
"GO-2026-6088"
],
"CVE": [
"CVE-2026-56859"
],
"CWE": [
"CWE-674"
]
},
"packageName": "std/encoding/xml",
"proprietary": false,
"creationTime": "2026-08-16T13:30:41.577448Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T21:43:54Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "golang",
"publicationTime": "2026-08-16T13:30:41.759190Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T02:00:45.639999Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"github.com/microsoft/typescript-go@*",
"stdlib@1.26.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "stdlib",
"version": "1.26.4"
},
{
"id": "SNYK-GOLANG-STDNET-18858450",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Mundur"
],
"semver": {
"vulnerable": [
">=1.26.0-0 <1.26.6",
">=1.27.0-0 <1.27.0-rc.3"
],
"hashesRange": [
">=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.\n## Remediation\nUpgrade `std/net` to version 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5942)\n- [Go Code Review](https://go.dev/cl/786345)\n- [Go Issue](https://go.dev/issue/79795)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n",
"epssDetails": {
"percentile": "0.44322",
"probability": "0.00549",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"GO": [
"GO-2026-5942"
],
"CVE": [
"CVE-2026-46600"
],
"CWE": [
"CWE-248"
]
},
"packageName": "std/net",
"proprietary": false,
"creationTime": "2026-08-16T13:29:52.132717Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-14T17:29:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "golang",
"publicationTime": "2026-08-16T13:29:52.316607Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T17:47:04.849623Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"github.com/microsoft/typescript-go@*",
"stdlib@1.26.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "stdlib",
"version": "1.26.4"
},
{
"id": "SNYK-GOLANG-STDNETHTTP-18858429",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.25.13",
">=1.26.0-0 <1.26.6",
">=1.27.0-0 <1.27.0-rc.3"
],
"hashesRange": [
"=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/http` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6089)\n- [Go Code Review](https://go.dev/cl/795540)\n- [Go Issue](https://go.dev/issue/80205)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n",
"epssDetails": {
"percentile": "0.44468",
"probability": "0.00568",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"GO": [
"GO-2026-6089"
],
"CVE": [
"CVE-2026-56853"
],
"CWE": [
"CWE-400"
]
},
"packageName": "std/net/http",
"proprietary": false,
"creationTime": "2026-08-16T13:28:12.349185Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T21:43:54Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "golang",
"publicationTime": "2026-08-16T13:28:12.649447Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T02:00:46.191702Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"github.com/microsoft/typescript-go@*",
"stdlib@1.26.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "stdlib",
"version": "1.26.4"
},
{
"id": "SNYK-GOLANG-STDNETURL-18858438",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.25.13",
">=1.26.0-0 <1.26.6",
">=1.27.0-0 <1.27.0-rc.3"
],
"hashesRange": [
"=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/url` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6218)\n- [Go Code Review](https://go.dev/cl/803681)\n- [Go Issue](https://go.dev/issue/80494)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n",
"epssDetails": {
"percentile": "0.43587",
"probability": "0.00550",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"GO": [
"GO-2026-6218"
],
"CVE": [
"CVE-2026-56860"
],
"CWE": [
"CWE-400"
]
},
"packageName": "std/net/url",
"proprietary": false,
"creationTime": "2026-08-16T13:28:43.607348Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T21:43:54Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "golang",
"publicationTime": "2026-08-16T13:28:43.780899Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:00:42.599966Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"github.com/microsoft/typescript-go@*",
"stdlib@1.26.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "stdlib",
"version": "1.26.4"
},
{
"id": "SNYK-GOLANG-STDOS-17905377",
"title": "Symlink Attack",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Mundur"
],
"semver": {
"vulnerable": [
"<1.25.12",
">=1.26.0-0 <1.26.5",
">=1.27.0-0 <1.27.0-rc.2"
],
"hashesRange": [
"=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.\n## Remediation\nUpgrade `std/os` to version 1.25.12, 1.26.5, 1.27.0-rc.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4970)\n- [Go Code Review](https://go.dev/cl/797880)\n- [Go Issue](https://go.dev/issue/79005)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc)\n",
"epssDetails": {
"percentile": "0.12762",
"probability": "0.00232",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"GO": [
"GO-2026-4970"
],
"CVE": [
"CVE-2026-39822"
],
"CWE": [
"CWE-59"
]
},
"packageName": "std/os",
"proprietary": false,
"creationTime": "2026-07-09T11:52:28.124727Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-07T21:34:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "golang",
"publicationTime": "2026-07-09T11:52:28.309070Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T14:05:23.087760Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"github.com/microsoft/typescript-go@*",
"stdlib@1.26.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "stdlib",
"version": "1.26.4"
}
],
"ok": false,
"dependencyCount": 17,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "gomodules",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "7 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 7,
"targetFile": "/opt/scopear/.npm-global/lib/node_modules/typescript/node_modules/@typescript/typescript-linux-x64/lib/tsc",
"projectName": "github.com/microsoft/typescript-go",
"displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules/typescript/node_modules/@typescript/typescript-linux-x64/lib/tsc",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-mc:2.51.7_71819fb.4373/microsoft/typescript-go"
}
]
}