{
"vulnerabilities": [
{
"id": "SNYK-UBUNTU2204-NODEJS-17268893",
"cpes": [],
"title": "CVE-2026-45447",
"CVSSv3": null,
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": null,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447"
},
{
"url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt",
"title": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25237",
"title": "https://access.redhat.com/errata/RHSA-2026:25237"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239",
"title": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26275",
"title": "https://access.redhat.com/errata/RHSA-2026:26275"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26319",
"title": "https://access.redhat.com/errata/RHSA-2026:26319"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:29197",
"title": "https://access.redhat.com/errata/RHSA-2026:29197"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34102",
"title": "https://access.redhat.com/errata/RHSA-2026:34102"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35869",
"title": "https://access.redhat.com/errata/RHSA-2026:35869"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36215",
"title": "https://access.redhat.com/errata/RHSA-2026:36215"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36217",
"title": "https://access.redhat.com/errata/RHSA-2026:36217"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39009",
"title": "https://access.redhat.com/errata/RHSA-2026:39009"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39012",
"title": "https://access.redhat.com/errata/RHSA-2026:39012"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39981",
"title": "https://access.redhat.com/errata/RHSA-2026:39981"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45447",
"title": "https://access.redhat.com/security/cve/CVE-2026-45447"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json",
"title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:44438",
"title": "https://access.redhat.com/errata/RHSA-2026:44438"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47735",
"title": "https://access.redhat.com/errata/RHSA-2026:47735"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47737",
"title": "https://access.redhat.com/errata/RHSA-2026:47737"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58563",
"title": "https://access.redhat.com/errata/RHSA-2026:58563"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58981",
"title": "https://access.redhat.com/errata/RHSA-2026:58981"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59831",
"title": "https://access.redhat.com/errata/RHSA-2026:59831"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:66524",
"title": "https://access.redhat.com/errata/RHSA-2026:66524"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"cvssSources": [
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n",
"epssDetails": {
"percentile": "0.90162",
"probability": "0.04002",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-45447"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": null,
"packageName": "nodejs",
"creationTime": "2026-06-10T02:46:34.655313Z",
"disclosureTime": "2026-06-09T17:17:19.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-06-10T02:46:34.660471Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-09-25T21:42:07.304624Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-wlc2-pp@2.51.7_71819fb.4373",
"nodejs@24.21.0-1nodesource1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "nodejs",
"version": "24.21.0-1nodesource1"
},
{
"id": "SNYK-UBUNTU2204-NODEJS-20266986",
"cpes": [],
"title": "CVE-2026-84782",
"CVSSv3": null,
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": null,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782"
},
{
"url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943",
"title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943"
},
{
"url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628",
"title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628"
},
{
"url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58",
"title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58"
},
{
"url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c",
"title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c"
},
{
"url": "https://openssl-library.org/news/secadv/20260929.txt",
"title": "https://openssl-library.org/news/secadv/20260929.txt"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-30T05:53:20.212801Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-03T11:01:35.528611Z"
}
],
"cvssSources": [
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:53:20.212801Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-03T11:01:35.528611Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n",
"epssDetails": {
"percentile": "0.30690",
"probability": "0.00390",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84782"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": null,
"packageName": "nodejs",
"creationTime": "2026-09-30T03:05:00.936532Z",
"disclosureTime": "2026-09-29T16:17:12.500000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-09-30T03:05:00.939158Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-10-03T11:01:36.139633Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-wlc2-pp@2.51.7_71819fb.4373",
"nodejs@24.21.0-1nodesource1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "nodejs",
"version": "24.21.0-1nodesource1"
}
],
"ok": false,
"dependencyCount": 141,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "deb",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {
"binariesVulns": {
"issuesData": {},
"affectedPkgs": {}
},
"os": {
"prettyName": "Ubuntu 22.04.5 LTS"
}
},
"summary": "2 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 2,
"projectName": "docker-image|docker.io/scopear/docker-wlc2-pp",
"platform": "linux/amd64",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-pp:2.51.7_71819fb.4373/scopear/docker-wlc2-pp",
"applications": [
{
"vulnerabilities": [
{
"id": "SNYK-JS-AXIOS-20245042",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"groot"
],
"semver": {
"vulnerable": [
">=1.16.1 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:23.137183Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:38:12.806890Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:38:12.806890Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:23.137183Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via improper validation of runtime options in `resolveConfig` and related helpers, where an attacker-controlled or malformed configuration value can trigger a crash in the request processing pipeline. The hardening of option handling across `fetch.js`, `http.js`, `dispatchRequest.js`, and supporting helpers indicates that unsanitized option objects could be passed through to the underlying fetch or HTTP adapter in a way that causes an unhandled runtime error, crashing the process and denying service to other users.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r)\n",
"epssDetails": {
"percentile": "0.29698",
"probability": "0.00382",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101903"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c29m-xwm3-cm6r"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:43:27.441172Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:24Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:43:27.601734Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:38:12.806890Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245044",
"title": "Improper Validation of Specified Quantity in Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"RelunSec"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:38:20.852962Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:38:20.852962Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization or allowlist enforcement. An attacker who can influence request configuration can supply option values that override Axios-owned fields (such as `signal`, `method`, `headers`, or `body`) or inject unexpected fetch option keys, causing the request pipeline to crash and producing a denial of service.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8)\n",
"epssDetails": {
"percentile": "0.29838",
"probability": "0.00384",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101901"
],
"CWE": [
"CWE-1284"
],
"GHSA": [
"GHSA-542g-h47m-68v8"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:49:45.410625Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:43Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:49:45.572984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:38:20.852962Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245046",
"title": "Improper Validation of Specified Quantity in Input",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"RelunSec"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:39.672628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:39.672628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:43.620080Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization or allowlist enforcement. An attacker who can influence request configuration can supply option values that override Axios-owned fields (such as `signal`, `method`, `headers`, or `body`) or inject unexpected fetch option keys, causing the request pipeline to crash and producing a denial of service.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8)\n",
"epssDetails": {
"percentile": "0.29838",
"probability": "0.00384",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101901"
],
"CWE": [
"CWE-1284"
],
"GHSA": [
"GHSA-542g-h47m-68v8"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:55:07.211008Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:43Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:55:07.384339Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:39.672628Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245048",
"title": "Unintended Proxy or Intermediary ('Confused Deputy')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"credit": [
"David Carliez"
],
"semver": {
"vulnerable": [
">=1.15.2 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-29T05:42:56.881452Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.6,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:48.255859Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:48.255859Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:56.881452Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via insufficient hardening of runtime option handling in the fetch and HTTP adapters (`lib/adapters/fetch.js`, `lib/adapters/http.js`, and related helpers). An authenticated attacker can supply malicious request options that are passed through without sanitization, allowing them to override Axios-controlled fetch properties such as `body`, `headers`, `method`, `signal`, `duplex`, and `credentials`, leading to a full compromise of request confidentiality and integrity.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3)\n",
"epssDetails": {
"percentile": "0.19290",
"probability": "0.00289",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101905"
],
"CWE": [
"CWE-441"
],
"GHSA": [
"GHSA-m8m8-qj5v-23w3"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T07:55:52.908103Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:23Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:55:53.121095Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:48.255859Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245056",
"title": "Unintended Proxy or Intermediary ('Confused Deputy')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"credit": [
"McDubh"
],
"semver": {
"vulnerable": [
">=1.17.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-29T05:42:50.608977Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:09.975186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:09.975186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:50.608977Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via improper enforcement of `maxRedirects: 0` in the fetch adapter, where user-supplied `fetchOptions` are merged into the resolved request options without defaulting the `redirect` field. When a caller sets `maxRedirects: 0` to prevent redirects, the fetch adapter does not apply `redirect: 'manual'` unless the caller also explicitly sets `fetchOptions.redirect`, causing the underlying fetch runtime to silently follow a `302` redirect from the initial target and forward the request - including any credentials or sensitive headers - to the redirect destination, which may be attacker-controlled.\r\n\r\n**Note:** This is only exploitable when requests are configured with `maxRedirects: 0` but without `fetchOptions.redirect: 'manual'` or an equivalent runtime-specific redirect control.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh)\n",
"epssDetails": {
"percentile": "0.33172",
"probability": "0.00414",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101907"
],
"CWE": [
"CWE-441"
],
"GHSA": [
"GHSA-r4gj-5m52-g5wh"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:02:07.482079Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T19:32:38Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:02:07.647927Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:09.975186Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245060",
"title": "Server-side Request Forgery (SSRF)",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"credit": [
"HamdaanAliQuatil"
],
"semver": {
"vulnerable": [
">=1.13.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.8,
"modificationTime": "2026-09-29T05:42:44.788930Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:27.159529Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:27.159529Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:44.788930Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via unsafe merging of user-supplied `fetchOptions` into the resolved request options object in `lib/adapters/fetch.js`. An attacker who controls request configuration can supply a `fetchOptions` object with prototype-polluting keys (e.g. `__proto__` or `constructor`), which are spread directly into the options passed to the Fetch API without sanitization, allowing pollution of `Object.prototype` and affecting downstream system-level behaviour. The fix replaces the spread with `Object.assign(Object.create(null), fetchOptions)` to strip inherited properties and enforces an allowlist of safe Fetch API keys.\r\n\r\n**Note:** This is only exploitable when the attacker can influence the `fetchOptions` configuration passed to axios requests.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v)\n",
"epssDetails": {
"percentile": "0.42391",
"probability": "0.00527",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101898"
],
"CWE": [
"CWE-918"
],
"GHSA": [
"GHSA-3pq3-5fj3-cg6v"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:08:29.503613Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:40Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:08:29.828583Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:27.159529Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245062",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"zaneins"
],
"semver": {
"vulnerable": [
">=1.15.0 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:43:00.363038Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:37:35.786750Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:37:35.786750Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:43:00.363038Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied `fetchOptions` are merged into the resolved request options without sanitization. An attacker who can influence request configuration can trigger uncontrolled resource consumption, crashing the process.\r\n\r\n**Note:** This is only exploitable when requests follow redirects (i.e., `maxRedirects` is not set to `0`), unless application code manually follows the malicious redirect and re-enters axios.\n## Remediation\nUpgrade `axios` to version 1.20.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj)\n",
"epssDetails": {
"percentile": "0.31831",
"probability": "0.00402",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101906"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mghh-pgcx-3jjj"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:09:30.186140Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T18:32:27Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:09:30.380901Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:37:35.786750Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-AXIOS-20245066",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P",
"credit": [
"Barnabas Charumbuka"
],
"semver": {
"vulnerable": [
">=0.28.0 <0.34.0",
">=1.15.1 <1.20.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.34.0",
"1.20.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/11141",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-29T05:42:48.026289Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:36:13.180160Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:36:13.180160Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:42:48.026289Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling across multiple request-processing helpers (`lib/helpers/resolveConfig.js`, `lib/helpers/toFormData.js`, `lib/adapters/fetch.js`, and related files). An attacker can supply a manipulated configuration object that overrides internally owned fetch options (such as `body`, `headers`, `method`, `signal`) or bypasses the default `formSerializer.maxDepth` limit, leading to integrity violations in outgoing requests or a crash causing denial of service.\r\n\r\n**Note:** This is only exploitable when the caller does not explicitly set `formSerializer.maxDepth`, allowing a prototype-level or caller-supplied value to override the expected default.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 0.34.0, 1.20.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f)\n- [GitHub Commit](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)\n- [GitHub Commit](https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b)\n- [GitHub PR](https://github.com/axios/axios/pull/11141)\n",
"epssDetails": {
"percentile": "0.26599",
"probability": "0.00354",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-101909"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-x97p-jq2g-jp4f"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-09-29T08:23:19.571870Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T19:32:44Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T08:23:19.790565Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:36:13.180160Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"axios@1.18.1"
],
"upgradePath": [
false,
"axios@1.20.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.18.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"brace-expansion@5.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"brace-expansion@5.0.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"brace-expansion@5.0.11"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"brace-expansion@5.0.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/config-array@0.23.5",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"@eslint/config-array@0.23.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/config-array@0.23.5",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"@eslint/config-array@0.23.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/config-array@0.23.5",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"@eslint/config-array@0.23.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/config-array@0.23.5",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"@eslint/config-array@0.23.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@10.8.1",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"eslint@10.8.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@10.8.1",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"eslint@10.8.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@10.8.1",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"eslint@10.8.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@10.8.1",
"brace-expansion@5.0.7"
],
"upgradePath": [
false,
"eslint@10.8.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "5.0.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"test-exclude@7.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.1.4"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.1.4"
},
{
"id": "SNYK-JS-BRACES-19963945",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "braces",
"references": [
{
"url": "https://github.com/micromatch/braces/issues/70",
"title": "GitHub Issue"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js%23L49-L53",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js%23L102-L105",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js%23L38-L40",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:03.538327Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:03.538327Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T18:30:36.009747Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:21.335214Z"
}
],
"description": "## Overview\n[braces](https://www.npmjs.com/package/braces) is a Bash-like brace expansion, implemented in JavaScript.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught `RangeError`.\n## Remediation\nThere is no fixed version for `braces`.\n## References\n- [GitHub Issue](https://github.com/micromatch/braces/issues/70)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/compile.js#L49-L53)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/expand.js#L102-L105)\n- [Vulnerable Code](https://github.com/micromatch/braces/blob/3.0.3/lib/parse.js#L38-L40)\n",
"epssDetails": {
"percentile": "0.53919",
"probability": "0.00757",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93687"
],
"CWE": [
"CWE-674"
]
},
"packageName": "braces",
"proprietary": false,
"creationTime": "2026-09-20T07:45:12.687490Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:35:24Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T07:45:12.861805Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:03.538327Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/jest@29.5.14",
"expect@29.7.0",
"jest-message-util@29.7.0",
"micromatch@4.0.8",
"braces@3.0.3"
],
"upgradePath": [
false,
"@types/jest@30.0.0",
"expect@30.5.2",
"jest-message-util@30.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "braces",
"version": "3.0.3"
},
{
"id": "SNYK-JS-EXTRACTZIP-17660777",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"credit": [
"Ziad Salah"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json",
"title": "Advisory"
},
{
"url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf",
"title": "GitHub Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:23:58.096190Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:23:58.096190Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n",
"epssDetails": {
"percentile": "0.42049",
"probability": "0.00526",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56876"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-x7jf-2287-qcpf"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-06-28T07:51:29.464799Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T18:15:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-28T07:51:29.629427Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:23:58.096190Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-EXTRACTZIP-19653641",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650",
"title": "GitHub Commit"
},
{
"url": "https://github.com/max-mapper/extract-zip/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-14T10:08:30.140412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n",
"epssDetails": {
"percentile": "0.20481",
"probability": "0.00280",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19693"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-7pqw-9j4j-h8q3"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-09-09T14:54:22.763062Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-17T15:30:40Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T14:54:23.005562Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-14T10:08:30.140412Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-HANDLEBARS-20557395",
"title": "Incomplete List of Disallowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Brandon T. Elliott"
],
"semver": {
"vulnerable": [
">=4.6.0 <4.7.10"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the `lookupProperty` function in `lib/handlebars/runtime.js`, which returns the resolved value as soon as `Object.prototype.hasOwnProperty.call(parent, propertyName)` holds, without consulting the prototype access deny list, and `constructor` is an own property of every prototype object, so `Function.prototype.constructor` resolves to `Function` itself. An attacker can execute code on the server by rendering a template that walks to a prototype and reads its constructor, as in `{{lookup (lookup fn \"__proto__\") \"constructor\"}}`. This requires the attacker to control the template rather than only the data, and compilation with `allowProtoMethodsByDefault: true`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by leaving `allowProtoMethodsByDefault` at its default of false when compiling untrusted templates.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.33286",
"probability": "0.00411",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106445"
],
"CWE": [
"CWE-184"
],
"GHSA": [
"GHSA-p8wg-vrv2-v86f"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-07T12:22:11.306334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T21:16:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T12:22:11.534110Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:00.379948Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-HANDLEBARS-20574183",
"title": "Access of Resource Using Incompatible Type ('Type Confusion')",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Nick Mykhailyshyn",
"bhaswanthc",
"Lương Nguyễn Ngọc Đình",
"jmoritzc53",
"n0tra4e",
"hibrian827",
"Thai Son Dinh",
"Nikola Kojic",
"Ahmed Elmahgob",
"vk-can",
"PellaML",
"shenhuanageshei",
"kagebunsher",
"kustundag",
"ffasterss",
"sanmatte"
],
"semver": {
"vulnerable": [
">=4.0.0 <4.7.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the compiler's handling of pre-parsed AST objects passed to `compile` or `precompile`. When a caller supplies a hand-built or attacker-influenced AST directly to the compiler, AST node values such as path depths, path parts, literal values, content strings, hash pair keys, and block params are written into generated JavaScript code without sufficient validation, allowing an attacker to inject arbitrary code into the compiled template output. The fix moves all AST value validation into the compiler itself, so that values are checked at the point they are written into generated code rather than only at parse time.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.49055",
"probability": "0.00640",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106446"
],
"CWE": [
"CWE-843",
"CWE-94"
],
"GHSA": [
"GHSA-8r5x-fm3f-whwj"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-08T21:01:07.219662Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-08T17:52:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-08T21:01:07.443371Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:04.407777Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-HANDLEBARS-20557395",
"title": "Incomplete List of Disallowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Brandon T. Elliott"
],
"semver": {
"vulnerable": [
">=4.6.0 <4.7.10"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:00.379948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:51:57.290614Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the `lookupProperty` function in `lib/handlebars/runtime.js`, which returns the resolved value as soon as `Object.prototype.hasOwnProperty.call(parent, propertyName)` holds, without consulting the prototype access deny list, and `constructor` is an own property of every prototype object, so `Function.prototype.constructor` resolves to `Function` itself. An attacker can execute code on the server by rendering a template that walks to a prototype and reads its constructor, as in `{{lookup (lookup fn \"__proto__\") \"constructor\"}}`. This requires the attacker to control the template rather than only the data, and compilation with `allowProtoMethodsByDefault: true`.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by leaving `allowProtoMethodsByDefault` at its default of false when compiling untrusted templates.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.33286",
"probability": "0.00411",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106445"
],
"CWE": [
"CWE-184"
],
"GHSA": [
"GHSA-p8wg-vrv2-v86f"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-07T12:22:11.306334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T21:16:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-07T12:22:11.534110Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:00.379948Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"ts-jest@29.4.12",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"ts-jest@29.4.12",
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-HANDLEBARS-20574183",
"title": "Access of Resource Using Incompatible Type ('Type Confusion')",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Nick Mykhailyshyn",
"bhaswanthc",
"Lương Nguyễn Ngọc Đình",
"jmoritzc53",
"n0tra4e",
"hibrian827",
"Thai Son Dinh",
"Nikola Kojic",
"Ahmed Elmahgob",
"vk-can",
"PellaML",
"shenhuanageshei",
"kagebunsher",
"kustundag",
"ffasterss",
"sanmatte"
],
"semver": {
"vulnerable": [
">=4.0.0 <4.7.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"4.7.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "handlebars",
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/pull/2185",
"title": "GitHub PR"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:04.407777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-10T07:52:02.688139Z"
}
],
"description": "## Overview\n[handlebars](https://www.npmjs.com/package/handlebars) is an extension to the Mustache templating language.\n\nAffected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the compiler's handling of pre-parsed AST objects passed to `compile` or `precompile`. When a caller supplies a hand-built or attacker-influenced AST directly to the compiler, AST node values such as path depths, path parts, literal values, content strings, hash pair keys, and block params are written into generated JavaScript code without sufficient validation, allowing an attacker to inject arbitrary code into the compiled template output. The fix moves all AST value validation into the compiler itself, so that values are checked at the point they are written into generated code rather than only at parse time.\n## Remediation\nUpgrade `handlebars` to version 4.7.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj)\n- [GitHub Commit](https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2)\n- [GitHub PR](https://github.com/handlebars-lang/handlebars.js/pull/2185)\n- [GitHub Release](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)\n",
"epssDetails": {
"percentile": "0.49055",
"probability": "0.00640",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-106446"
],
"CWE": [
"CWE-843",
"CWE-94"
],
"GHSA": [
"GHSA-8r5x-fm3f-whwj"
]
},
"packageName": "handlebars",
"proprietary": false,
"creationTime": "2026-10-08T21:01:07.219662Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-08T17:52:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-08T21:01:07.443371Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-10T07:52:04.407777Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"services@*",
"ts-jest@29.4.12",
"handlebars@4.7.9"
],
"upgradePath": [
false,
"ts-jest@29.4.12",
"handlebars@4.7.10"
],
"isUpgradable": true,
"isPatchable": false,
"name": "handlebars",
"version": "4.7.9"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"@jest/reporters@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"babel-jest@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-resolve-dependencies@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"jest-config@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-runner@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.43259",
"probability": "0.00541",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh",
"GHSA-r3ph-w7gj-g6xm"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T09:27:34.868907Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.1"
],
"upgradePath": [
false,
"jest@30.5.1",
"jest-cli@30.5.1",
"@jest/core@30.5.1",
"jest-config@30.5.1",
"jest-circus@30.5.1",
"jest-runtime@30.5.1",
"@jest/globals@30.5.1",
"@jest/expect@30.5.1",
"jest-snapshot@30.5.1",
"@jest/transform@30.5.1",
"babel-plugin-istanbul@8.0.0",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.1"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T09:27:34.868907Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T05:41:08.026471Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<