{ "vulnerabilities": [ { "id": "SNYK-UBUNTU2204-LUA51-16055377", "cpes": [], "title": "Use After Free", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P", "credit": [ "" ], "semver": { "vulnerable": [ "<5.1.5-8.1ubuntu0.22.04.1~esm1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "5.1.5-8.1ubuntu0.22.04.1~esm1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 9.9, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844" }, { "url": "https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539", "title": "https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539" }, { "url": "https://github.com/redis/redis/releases/tag/8.2.2", "title": "https://github.com/redis/redis/releases/tag/8.2.2" }, { "url": "https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q", "title": "https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q" }, { "url": "http://www.openwall.com/lists/oss-security/2025/10/07/2", "title": "http://www.openwall.com/lists/oss-security/2025/10/07/2" }, { "url": "https://github.com/lastvocher/redis-CVE-2025-49844", "title": "https://github.com/lastvocher/redis-CVE-2025-49844" }, { "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml", "title": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.9, "modificationTime": "2025-10-08T01:13:35.627789Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.8, "modificationTime": "2025-10-06T21:51:55.693804Z" }, { "assigner": "SUSE", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.9, "modificationTime": "2025-10-09T11:02:48.267745Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.9, "cvssVersion": "3.1", "modificationTime": "2025-10-08T01:13:35.627789Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.8, "cvssVersion": "3.1", "modificationTime": "2025-10-06T21:51:55.693804Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "critical", "baseScore": 9.9, "cvssVersion": "3.1", "modificationTime": "2025-10-09T11:02:48.267745Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `lua5.1` package and not the `lua5.1` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nRedis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.\n## Remediation\nUpgrade `Ubuntu:22.04` `lua5.1` to version 5.1.5-8.1ubuntu0.22.04.1~esm1 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844)\n- [https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539](https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539)\n- [https://github.com/redis/redis/releases/tag/8.2.2](https://github.com/redis/redis/releases/tag/8.2.2)\n- [https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q](https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q)\n- [http://www.openwall.com/lists/oss-security/2025/10/07/2](http://www.openwall.com/lists/oss-security/2025/10/07/2)\n- [https://github.com/lastvocher/redis-CVE-2025-49844](https://github.com/lastvocher/redis-CVE-2025-49844)\n- [https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml](https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml)\n", "epssDetails": { "percentile": "0.99636", "probability": "0.82294", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-49844" ], "CWE": [ "CWE-416" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "lua5.1", "creationTime": "2026-04-15T03:23:11.908597Z", "disclosureTime": "2025-10-03T20:15:32.823000Z", "exploitDetails": { "sources": [ "Nuclei Templates", "PoC in GitHub" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:22.04", "publicationTime": "2026-04-15T03:23:11.913504Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-19T03:48:51.114823Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/scope-cms@3.47.2_07138dc.1608", "redis@5:6.0.16-1ubuntu1.2", "redis/redis-server@5:6.0.16-1ubuntu1.2", "redis/redis-tools@5:6.0.16-1ubuntu1.2", "lua5.1/liblua5.1-0@5.1.5-8.1build4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "lua5.1/liblua5.1-0", "version": "5.1.5-8.1build4", "nearestFixedInVersion": "5.1.5-8.1ubuntu0.22.04.1~esm1" }, { "id": "SNYK-UBUNTU2204-LUABITOP-16055370", "cpes": [], "title": "Stack-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.0.2-5ubuntu0.22.04.1~esm2" ] }, "exploit": "Not Defined", "fixedIn": [ "1.0.2-5ubuntu0.22.04.1~esm2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.8, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449" }, { "url": "https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9", "title": "https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9" }, { "url": "https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5", "title": "https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.8, "modificationTime": "2025-09-05T01:13:20.390177Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2024-10-09T13:46:25.968279Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.8, "modificationTime": "2024-10-08T11:01:53.868866Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.8, "cvssVersion": "3.1", "modificationTime": "2025-09-05T01:13:20.390177Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2024-10-09T13:46:25.968279Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.8, "cvssVersion": "3.1", "modificationTime": "2024-10-08T11:01:53.868866Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `lua-bitop` package and not the `lua-bitop` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nRedis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n## Remediation\nUpgrade `Ubuntu:22.04` `lua-bitop` to version 1.0.2-5ubuntu0.22.04.1~esm2 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449)\n- [https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9](https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9)\n- [https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5](https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5)\n", "epssDetails": { "percentile": "0.90389", "probability": "0.04495", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2024-31449" ], "CWE": [ "CWE-121", "CWE-20" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "lua-bitop", "creationTime": "2026-04-15T03:23:03.937336Z", "disclosureTime": "2024-10-07T20:15:05.507000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:22.04", "publicationTime": "2026-04-15T03:23:03.941651Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-19T03:48:07.629178Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/scope-cms@3.47.2_07138dc.1608", "redis@5:6.0.16-1ubuntu1.2", "redis/redis-server@5:6.0.16-1ubuntu1.2", "redis/redis-tools@5:6.0.16-1ubuntu1.2", "lua-bitop@1.0.2-5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "lua-bitop", "version": "1.0.2-5", "nearestFixedInVersion": "1.0.2-5ubuntu0.22.04.1~esm2" }, { "id": "SNYK-UPSTREAM-NODE-15763402", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "mbarbs" ], "semver": { "vulnerable": [ "[,20.20.2)", "[21.0.0,22.22.2)", "[23.0.0,24.14.1)", "[25.0.0,25.8.2)" ] }, "exploit": "Not Defined", "fixedIn": [ "20.20.2", "22.22.2", "24.14.1", "25.8.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/85f73e7057e9badf6e7713f7440769375cdb5df5", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", "title": "Node.js Security Releases" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-03-25T15:07:16.499813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-03-25T15:07:16.499813Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Uncaught Exception in the TLS module when a `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.\r\n\r\n**Note:**\r\n\r\nThis is caused by an incomplete fix for [CVE-2026-21637](https://security.snyk.io/vuln/SNYK-UNMANAGED-NODEJSNODE-14982194).\n## Remediation\nUpgrade `node` to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/85f73e7057e9badf6e7713f7440769375cdb5df5)\n- [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)\n", "epssDetails": null, "identifiers": { "CVE": [], "CWE": [ "CWE-248" ] }, "packageName": "node", "creationTime": "2026-03-25T15:07:16.175367Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T15:03:05Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-03-25T15:07:16.478418Z", "severityBasedOn": "CVSS", "modificationTime": "2026-03-25T15:07:16.499813Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.22.2" }, { "id": "SNYK-UPSTREAM-NODE-15763406", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "yushengchen" ], "semver": { "vulnerable": [ "[,20.20.2)", "[21.0.0,22.22.2)", "[23.0.0,24.14.1)", "[25.0.0,25.8.2)" ] }, "exploit": "Not Defined", "fixedIn": [ "20.20.2", "22.22.2", "24.14.1", "25.8.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/00ad47a28e", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", "title": "Node.js Security Releases" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-04T12:22:11.002541Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-15T11:52:27.579789Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-20T14:04:39.620337Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-20T14:04:39.620337Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-04T12:22:11.002541Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-15T11:52:27.579789Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named `__proto__` and the server application accesses `req.headersDistinct`. This causes `dest[\"__proto__\"]` to incorrectly resolve to `Object.prototype`, resulting in an uncaught TypeError when `.push()` is called on a non-array. Because this exception is thrown synchronously inside a property getter, standard error listeners cannot intercept it. This causes the Node.js process to crash unless every access is explicitly wrapped in a try/catch block.\n## Remediation\nUpgrade `node` to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/00ad47a28e)\n- [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)\n", "epssDetails": { "percentile": "0.97749", "probability": "0.25044", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-21710" ], "CWE": [ "CWE-248" ] }, "packageName": "node", "creationTime": "2026-03-25T15:20:50.610078Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T15:18:26Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-03-25T15:20:50.872353Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-20T14:04:39.620337Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.22.2" }, { "id": "SNYK-UPSTREAM-NODE-17674807", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "erichen" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.0)", "[23.0.0, 24.17.0)", "[25.0.0, 26.3.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.0", "24.17.0", "26.3.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "title": "Node.js Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-27T06:47:40.179091Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-26T11:01:41.429545Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-27T14:04:50.747064Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-27T14:04:50.747064Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-27T06:47:40.179091Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.429545Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the WebCrypto cipher output length calculation in `src/crypto/crypto_aes.cc`, where `data_len + blockSize + tag_len` is computed as a signed `int` before being passed to OpenSSL. An attacker can abort the process and cause a denial of service by passing an input around a multiple of 2 GiB to `subtle.encrypt()`, which overflows that length computation and crashes the runtime.\n## Remediation\nUpgrade `node` to version 22.23.0, 24.17.0, 26.3.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff)\n- [Node.js Advisory](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)\n", "epssDetails": { "percentile": "0.89370", "probability": "0.03711", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48933" ], "CWE": [ "CWE-190" ] }, "packageName": "node", "creationTime": "2026-06-29T14:31:58.946820Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-26T02:08:32.113000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-06-29T14:31:59.135778Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:04:50.747064Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.23.0" }, { "id": "SNYK-UPSTREAM-NODE-18507942", "title": "Improper Certificate Validation", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "credit": [ "vnyuh" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-08-05T06:03:44.647596Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-08-07T11:01:48.504262Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7, "cvssVersion": "4.0", "modificationTime": "2026-10-02T14:02:49.935746Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-02T14:02:49.935746Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-08-05T06:03:44.647596Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:48.504262Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Improper Certificate Validation due to the `HTTPS Agent` skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname validation.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62)\n- [GitHub Commit](https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c)\n- [GitHub Commit](https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.18321", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-58040" ], "CWE": [ "CWE-295" ] }, "packageName": "node", "creationTime": "2026-08-02T12:15:22.422438Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-30T15:48:41Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-02T12:15:22.587494Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-02T14:02:49.935746Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.23.2" }, { "id": "SNYK-UPSTREAM-NODE-18507943", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "credit": [ "sinan-polat" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.4, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 4.4, "modificationTime": "2026-08-05T05:50:30.795493Z" }, { "assigner": "SUSE", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "cvssV3BaseScore": 3.3, "modificationTime": "2026-08-07T11:01:49.032075Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.4, "cvssVersion": "4.0", "modificationTime": "2026-09-27T14:05:21.030048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "assigner": "Snyk", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-09-27T14:05:21.030048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 4.4, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:50:30.795493Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "assigner": "SUSE", "severity": "low", "baseScore": 3.3, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:49.032075Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the `process.report`. An attacker can access or overwrite files outside of the intended `--allow-fs-write` paths by leveraging this flaw to bypass security boundaries.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099)\n- [GitHub Commit](https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.03926", "probability": "0.00155", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-58039" ], "CWE": [ "CWE-22" ] }, "packageName": "node", "creationTime": "2026-08-02T12:15:46.875620Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-31T01:48:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-02T12:15:47.051773Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:05:21.030048Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.23.2" }, { "id": "SNYK-UPSTREAM-NODE-18553644", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "leduckhuong" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/f14d78b9e0", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-07T05:49:05.944858Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-07T11:01:47.905351Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-27T14:05:21.221490Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-27T14:05:21.221490Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-07T05:49:05.944858Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:47.905351Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756)\n- [GitHub Commit](https://github.com/nodejs/node/commit/f14d78b9e0)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.40376", "probability": "0.00500", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-56846" ], "CWE": [ "CWE-770" ] }, "packageName": "node", "creationTime": "2026-08-06T01:00:32.348238Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-04T03:55:16Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-06T01:00:46.764993Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:05:21.221490Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.23.2" }, { "id": "SNYK-UPSTREAM-NODE-18553648", "title": "Use After Free", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "hahahkim" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/23b94c843a", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-08T05:30:23.932871Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-07T11:01:48.414364Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-27T14:05:21.910908Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-27T14:05:21.910908Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-08T05:30:23.932871Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:48.414364Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when `nghttp2_session_mem_send()` is called re-entrantly during the execution of `nghttp2_session_mem_recv()`. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant calls, potentially leading to denial of service or other unpredictable behavior.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/23b94c843a)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.39699", "probability": "0.00490", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-56848" ], "CWE": [ "CWE-416" ] }, "packageName": "node", "creationTime": "2026-08-06T01:01:23.611072Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-04T18:13:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-06T01:01:45.203590Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:05:21.910908Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.23.2" }, { "id": "SNYK-UPSTREAM-NODE-18553653", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "cantina-security" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/22efc051a3", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-11T05:30:10.378598Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-07T11:01:49.572976Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T14:04:21.461449Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T14:04:21.461449Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-11T05:30:10.378598Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:49.572976Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `dns.resolveAny` function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DNS responses.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/22efc051a3)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a)\n- [GitHub Commit](https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.28315", "probability": "0.00369", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-58042" ], "CWE": [ "CWE-770" ] }, "packageName": "node", "creationTime": "2026-08-06T01:04:10.503438Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-04T03:54:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-06T01:04:21.066266Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T14:04:21.461449Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.23.2" }, { "id": "SNYK-UPSTREAM-NODE-18553660", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "byvini" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/b3fbb6e11f", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.2, "modificationTime": "2026-08-11T05:30:55.443628Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.2, "modificationTime": "2026-08-07T11:01:50.421860Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:23:48.353682Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:23:48.353682Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-08-11T05:30:55.443628Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:50.421860Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `node:zlib` synchronous APIs when a spoofed `TypedArray` `byteLength` triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this condition.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098)\n- [GitHub Commit](https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343)\n- [GitHub Commit](https://github.com/nodejs/node/commit/b3fbb6e11f)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.05245", "probability": "0.00167", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-58045" ], "CWE": [ "CWE-770" ] }, "packageName": "node", "creationTime": "2026-08-06T01:04:53.622382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-04T03:55:25Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-06T01:05:01.741048Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:23:48.353682Z", "socialTrendAlert": false, "packagePopularityRank": 0, "from": [ "Upstream", "node@22.22.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "node", "version": "22.22.0", "nearestFixedInVersion": "22.23.2" } ], "ok": false, "dependencyCount": 757, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "binariesVulns": { "issuesData": { "SNYK-UPSTREAM-NODE-15763402": { "id": "SNYK-UPSTREAM-NODE-15763402", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "mbarbs" ], "semver": { "vulnerable": [ "[,20.20.2)", "[21.0.0,22.22.2)", "[23.0.0,24.14.1)", "[25.0.0,25.8.2)" ] }, "exploit": "Not Defined", "fixedIn": [ "20.20.2", "22.22.2", "24.14.1", "25.8.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/85f73e7057e9badf6e7713f7440769375cdb5df5", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", "title": "Node.js Security Releases" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-03-25T15:07:16.499813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-03-25T15:07:16.499813Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Uncaught Exception in the TLS module when a `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.\r\n\r\n**Note:**\r\n\r\nThis is caused by an incomplete fix for [CVE-2026-21637](https://security.snyk.io/vuln/SNYK-UNMANAGED-NODEJSNODE-14982194).\n## Remediation\nUpgrade `node` to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/85f73e7057e9badf6e7713f7440769375cdb5df5)\n- [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)\n", "epssDetails": null, "identifiers": { "CVE": [], "CWE": [ "CWE-248" ] }, "packageName": "node", "creationTime": "2026-03-25T15:07:16.175367Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T15:03:05Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-03-25T15:07:16.478418Z", "severityBasedOn": "CVSS", "modificationTime": "2026-03-25T15:07:16.499813Z", "socialTrendAlert": false, "packagePopularityRank": 0 }, "SNYK-UPSTREAM-NODE-15763406": { "id": "SNYK-UPSTREAM-NODE-15763406", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "yushengchen" ], "semver": { "vulnerable": [ "[,20.20.2)", "[21.0.0,22.22.2)", "[23.0.0,24.14.1)", "[25.0.0,25.8.2)" ] }, "exploit": "Not Defined", "fixedIn": [ "20.20.2", "22.22.2", "24.14.1", "25.8.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/00ad47a28e", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", "title": "Node.js Security Releases" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-04T12:22:11.002541Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-15T11:52:27.579789Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-20T14:04:39.620337Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-20T14:04:39.620337Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-04T12:22:11.002541Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-15T11:52:27.579789Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named `__proto__` and the server application accesses `req.headersDistinct`. This causes `dest[\"__proto__\"]` to incorrectly resolve to `Object.prototype`, resulting in an uncaught TypeError when `.push()` is called on a non-array. Because this exception is thrown synchronously inside a property getter, standard error listeners cannot intercept it. This causes the Node.js process to crash unless every access is explicitly wrapped in a try/catch block.\n## Remediation\nUpgrade `node` to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/00ad47a28e)\n- [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)\n", "epssDetails": { "percentile": "0.97749", "probability": "0.25044", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-21710" ], "CWE": [ "CWE-248" ] }, "packageName": "node", "creationTime": "2026-03-25T15:20:50.610078Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T15:18:26Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-03-25T15:20:50.872353Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-20T14:04:39.620337Z", "socialTrendAlert": false, "packagePopularityRank": 0 }, "SNYK-UPSTREAM-NODE-17674807": { "id": "SNYK-UPSTREAM-NODE-17674807", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "erichen" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.0)", "[23.0.0, 24.17.0)", "[25.0.0, 26.3.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.0", "24.17.0", "26.3.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", "title": "Node.js Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-27T06:47:40.179091Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-26T11:01:41.429545Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-27T14:04:50.747064Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-27T14:04:50.747064Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-27T06:47:40.179091Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.429545Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the WebCrypto cipher output length calculation in `src/crypto/crypto_aes.cc`, where `data_len + blockSize + tag_len` is computed as a signed `int` before being passed to OpenSSL. An attacker can abort the process and cause a denial of service by passing an input around a multiple of 2 GiB to `subtle.encrypt()`, which overflows that length computation and crashes the runtime.\n## Remediation\nUpgrade `node` to version 22.23.0, 24.17.0, 26.3.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff)\n- [Node.js Advisory](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)\n", "epssDetails": { "percentile": "0.89370", "probability": "0.03711", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48933" ], "CWE": [ "CWE-190" ] }, "packageName": "node", "creationTime": "2026-06-29T14:31:58.946820Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-26T02:08:32.113000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-06-29T14:31:59.135778Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:04:50.747064Z", "socialTrendAlert": false, "packagePopularityRank": 0 }, "SNYK-UPSTREAM-NODE-18507942": { "id": "SNYK-UPSTREAM-NODE-18507942", "title": "Improper Certificate Validation", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "credit": [ "vnyuh" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-08-05T06:03:44.647596Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-08-07T11:01:48.504262Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7, "cvssVersion": "4.0", "modificationTime": "2026-10-02T14:02:49.935746Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-10-02T14:02:49.935746Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-08-05T06:03:44.647596Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:48.504262Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Improper Certificate Validation due to the `HTTPS Agent` skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname validation.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62)\n- [GitHub Commit](https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c)\n- [GitHub Commit](https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.18321", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-58040" ], "CWE": [ "CWE-295" ] }, "packageName": "node", "creationTime": "2026-08-02T12:15:22.422438Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-30T15:48:41Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-02T12:15:22.587494Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-02T14:02:49.935746Z", "socialTrendAlert": false, "packagePopularityRank": 0 }, "SNYK-UPSTREAM-NODE-18507943": { "id": "SNYK-UPSTREAM-NODE-18507943", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "credit": [ "sinan-polat" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.4, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 4.4, "modificationTime": "2026-08-05T05:50:30.795493Z" }, { "assigner": "SUSE", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "cvssV3BaseScore": 3.3, "modificationTime": "2026-08-07T11:01:49.032075Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.4, "cvssVersion": "4.0", "modificationTime": "2026-09-27T14:05:21.030048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "assigner": "Snyk", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-09-27T14:05:21.030048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 4.4, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:50:30.795493Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "assigner": "SUSE", "severity": "low", "baseScore": 3.3, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:49.032075Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the `process.report`. An attacker can access or overwrite files outside of the intended `--allow-fs-write` paths by leveraging this flaw to bypass security boundaries.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099)\n- [GitHub Commit](https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.03926", "probability": "0.00155", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-58039" ], "CWE": [ "CWE-22" ] }, "packageName": "node", "creationTime": "2026-08-02T12:15:46.875620Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-31T01:48:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-02T12:15:47.051773Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:05:21.030048Z", "socialTrendAlert": false, "packagePopularityRank": 0 }, "SNYK-UPSTREAM-NODE-18553644": { "id": "SNYK-UPSTREAM-NODE-18553644", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "leduckhuong" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/f14d78b9e0", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-07T05:49:05.944858Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-07T11:01:47.905351Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-27T14:05:21.221490Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-27T14:05:21.221490Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-07T05:49:05.944858Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:47.905351Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756)\n- [GitHub Commit](https://github.com/nodejs/node/commit/f14d78b9e0)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.40376", "probability": "0.00500", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-56846" ], "CWE": [ "CWE-770" ] }, "packageName": "node", "creationTime": "2026-08-06T01:00:32.348238Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-04T03:55:16Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-06T01:00:46.764993Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:05:21.221490Z", "socialTrendAlert": false, "packagePopularityRank": 0 }, "SNYK-UPSTREAM-NODE-18553648": { "id": "SNYK-UPSTREAM-NODE-18553648", "title": "Use After Free", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "hahahkim" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/23b94c843a", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-08T05:30:23.932871Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-07T11:01:48.414364Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-27T14:05:21.910908Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-27T14:05:21.910908Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-08T05:30:23.932871Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:48.414364Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when `nghttp2_session_mem_send()` is called re-entrantly during the execution of `nghttp2_session_mem_recv()`. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant calls, potentially leading to denial of service or other unpredictable behavior.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/23b94c843a)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.39699", "probability": "0.00490", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-56848" ], "CWE": [ "CWE-416" ] }, "packageName": "node", "creationTime": "2026-08-06T01:01:23.611072Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-04T18:13:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-06T01:01:45.203590Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:05:21.910908Z", "socialTrendAlert": false, "packagePopularityRank": 0 }, "SNYK-UPSTREAM-NODE-18553653": { "id": "SNYK-UPSTREAM-NODE-18553653", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "cantina-security" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/22efc051a3", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-11T05:30:10.378598Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-07T11:01:49.572976Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-29T14:04:21.461449Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-29T14:04:21.461449Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-11T05:30:10.378598Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:49.572976Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `dns.resolveAny` function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DNS responses.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/22efc051a3)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a)\n- [GitHub Commit](https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.28315", "probability": "0.00369", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-58042" ], "CWE": [ "CWE-770" ] }, "packageName": "node", "creationTime": "2026-08-06T01:04:10.503438Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-04T03:54:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-06T01:04:21.066266Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-29T14:04:21.461449Z", "socialTrendAlert": false, "packagePopularityRank": 0 }, "SNYK-UPSTREAM-NODE-18553660": { "id": "SNYK-UPSTREAM-NODE-18553660", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "byvini" ], "semver": { "vulnerable": [ "[22.0.0, 22.23.2)", "[24.0.0, 24.18.1)", "[26.0.0, 26.5.1)" ] }, "exploit": "Not Defined", "fixedIn": [ "22.23.2", "24.18.1", "26.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343", "title": "GitHub Commit" }, { "url": "https://github.com/nodejs/node/commit/b3fbb6e11f", "title": "GitHub Commit" }, { "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "title": "Node.js" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.2, "modificationTime": "2026-08-11T05:30:55.443628Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.2, "modificationTime": "2026-08-07T11:01:50.421860Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:23:48.353682Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:23:48.353682Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-08-11T05:30:55.443628Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-08-07T11:01:50.421860Z" } ], "description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `node:zlib` synchronous APIs when a spoofed `TypedArray` `byteLength` triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this condition.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098)\n- [GitHub Commit](https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343)\n- [GitHub Commit](https://github.com/nodejs/node/commit/b3fbb6e11f)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n", "epssDetails": { "percentile": "0.05245", "probability": "0.00167", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-58045" ], "CWE": [ "CWE-770" ] }, "packageName": "node", "creationTime": "2026-08-06T01:04:53.622382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-04T03:55:25Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "upstream", "publicationTime": "2026-08-06T01:05:01.741048Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:23:48.353682Z", "socialTrendAlert": false, "packagePopularityRank": 0 } }, "affectedPkgs": { "node@22.22.0": { "pkg": { "name": "node", "version": "22.22.0" }, "issues": { "SNYK-UPSTREAM-NODE-15763402": { "issueId": "SNYK-UPSTREAM-NODE-15763402", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.22.2" } ] } ], "nearestFixedInVersion": "22.22.2", "isRuntime": false, "isPinnable": false } }, "SNYK-UPSTREAM-NODE-15763406": { "issueId": "SNYK-UPSTREAM-NODE-15763406", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.22.2" } ] } ], "nearestFixedInVersion": "22.22.2", "isRuntime": false, "isPinnable": false } }, "SNYK-UPSTREAM-NODE-17674807": { "issueId": "SNYK-UPSTREAM-NODE-17674807", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.23.0" } ] } ], "nearestFixedInVersion": "22.23.0", "isRuntime": false, "isPinnable": false } }, "SNYK-UPSTREAM-NODE-18507942": { "issueId": "SNYK-UPSTREAM-NODE-18507942", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.23.2" } ] } ], "nearestFixedInVersion": "22.23.2", "isRuntime": false, "isPinnable": false } }, "SNYK-UPSTREAM-NODE-18507943": { "issueId": "SNYK-UPSTREAM-NODE-18507943", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.23.2" } ] } ], "nearestFixedInVersion": "22.23.2", "isRuntime": false, "isPinnable": false } }, "SNYK-UPSTREAM-NODE-18553644": { "issueId": "SNYK-UPSTREAM-NODE-18553644", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.23.2" } ] } ], "nearestFixedInVersion": "22.23.2", "isRuntime": false, "isPinnable": false } }, "SNYK-UPSTREAM-NODE-18553648": { "issueId": "SNYK-UPSTREAM-NODE-18553648", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.23.2" } ] } ], "nearestFixedInVersion": "22.23.2", "isRuntime": false, "isPinnable": false } }, "SNYK-UPSTREAM-NODE-18553653": { "issueId": "SNYK-UPSTREAM-NODE-18553653", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.23.2" } ] } ], "nearestFixedInVersion": "22.23.2", "isRuntime": false, "isPinnable": false } }, "SNYK-UPSTREAM-NODE-18553660": { "issueId": "SNYK-UPSTREAM-NODE-18553660", "fixInfo": { "isPatchable": false, "upgradePaths": [ { "path": [ { "name": "docker-image|docker.io/scopear/scope-cms", "version": "3.47.2_07138dc.1608" }, { "name": "node", "version": "22.22.0", "newVersion": "22.23.2" } ] } ], "nearestFixedInVersion": "22.23.2", "isRuntime": false, "isPinnable": false } } } } } }, "os": { "prettyName": "Ubuntu 22.04.5 LTS" } }, "summary": "11 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 11, "projectName": "docker-image|docker.io/scopear/scope-cms", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608/scopear/scope-cms", "applications": [ { "vulnerabilities": [ { "id": "SNYK-JS-JSYAML-17900054", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Mazze LeCzzare Frazer" ], "semver": { "vulnerable": [ ">=3.0.0 <3.15.0", ">=4.0.0 <4.3.0" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.15.0", "4.3.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "js-yaml", "references": [ { "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m", "title": "GitHub Advisory" }, { "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7", "title": "GitHub Commit" }, { "url": "https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1", "title": "GitHub Commit" }, { "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T05:39:27.194268Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-24T14:17:01.602187Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T14:17:01.602187Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T05:39:27.194268Z" } ], "description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity in merge key (`<<`) handling during YAML parsing, where each mapping in a chain re-enumerates the keys inherited from the previous mapping. An attacker can exhaust CPU and cause denial of service by supplying a document with N chained merge mappings, which forces roughly O(N^2) work for O(N) input. Exploitation requires the application to parse untrusted YAML with the default or YAML11 schema, under which merge keys are resolved.\n## Remediation\nUpgrade `js-yaml` to version 3.15.0, 4.3.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4)\n", "epssDetails": { "percentile": "0.45611", "probability": "0.00585", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59869" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-52cp-r559-cp3m" ] }, "packageName": "js-yaml", "proprietary": false, "creationTime": "2026-07-09T07:26:45.931900Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:08Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T07:26:46.274346Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:17:01.602187Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "shakapacker@9.7.0", "js-yaml@4.1.0" ], "upgradePath": [ false, "js-yaml@4.3.0" ], "isUpgradable": true, "isPatchable": false, "name": "js-yaml", "version": "4.1.0" }, { "id": "SNYK-JS-JSYAML-18593780", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "0xsharz" ], "semver": { "vulnerable": [ ">=3.0.0 <3.15.1", ">=4.0.0 <4.3.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.15.1", "4.3.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "js-yaml", "references": [ { "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj", "title": "GitHub Advisory" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-08T14:21:31.776417Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-08T14:21:31.776417Z" } ], "description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n", "epssDetails": null, "identifiers": { "CVE": [], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-5p4m-2wfm-xmqj" ] }, "packageName": "js-yaml", "proprietary": false, "creationTime": "2026-08-08T14:21:31.424058Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-06T20:27:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-08T14:21:31.607599Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-08T14:21:31.776417Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "shakapacker@9.7.0", "js-yaml@4.1.0" ], "upgradePath": [ false, "js-yaml@4.3.1" ], "isUpgradable": true, "isPatchable": false, "name": "js-yaml", "version": "4.1.0" }, { "id": "SNYK-JS-JSYAML-19496768", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.0.0 <3.15.2", ">=4.0.0 <4.3.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.15.2", "4.3.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "js-yaml", "references": [ { "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh", "title": "GitHub Advisory" }, { "url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639", "title": "GitHub Commit" }, { "url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480", "title": "GitHub Commit" }, { "url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b", "title": "GitHub Commit" }, { "url": "https://github.com/nodeca/js-yaml/pull/797", "title": "GitHub PR" }, { "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2", "title": "GitHub Release" }, { "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-30T05:41:08.026471Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-30T09:27:34.868907Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-30T09:27:34.868907Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:41:08.026471Z" } ], "description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n", "epssDetails": { "percentile": "0.43259", "probability": "0.00541", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84375" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-2883-xcg3-v3hh", "GHSA-r3ph-w7gj-g6xm" ] }, "packageName": "js-yaml", "proprietary": false, "creationTime": "2026-09-02T09:48:34.798885Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-02T00:39:25Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-02T09:48:35.070116Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T09:27:34.868907Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "shakapacker@9.7.0", "js-yaml@4.1.0" ], "upgradePath": [ false, "js-yaml@4.3.2" ], "isUpgradable": true, "isPatchable": false, "name": "js-yaml", "version": "4.1.0" } ], "ok": false, "dependencyCount": 27, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "yarn", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "3 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "remediation": { "unresolved": [], "upgrade": { "js-yaml@4.1.0": { "upgradeTo": "js-yaml@4.3.2", "upgrades": [ "js-yaml@4.1.0", "js-yaml@4.1.0", "js-yaml@4.1.0" ], "vulns": [ "SNYK-JS-JSYAML-19496768", "SNYK-JS-JSYAML-18593780", "SNYK-JS-JSYAML-17900054" ] } }, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 3, "targetFile": "/usr/local/bundle/gems/shakapacker-9.7.0/package.json", "projectName": "shakapacker", "displayTargetFile": "/usr/local/bundle/gems/shakapacker-9.7.0/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608" }, { "vulnerabilities": [ { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "package.json@*", "babel-plugin-styled-components@2.1.4", "picomatch@2.3.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "picomatch", "version": "2.3.2" } ], "ok": false, "dependencyCount": 557, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "yarn", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "1 high or critical severity vulnerable dependency path", "severityThreshold": "high", "remediation": { "unresolved": [ { "id": "SNYK-JS-PICOMATCH-21248802", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "maximilliangrand", "Zachariah Mithani" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/pull/194", "title": "GitHub PR" }, { "url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.991803Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-20T01:32:18.626388Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n", "epssDetails": null, "identifiers": { "CVE": [ "CVE-2026-112366" ], "CWE": [ "CWE-1333" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-10-19T19:21:10.678786Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-10-19T18:13:14.289000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-10-19T19:21:10.842984Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-20T01:32:18.991803Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "package.json@*", "babel-plugin-styled-components@2.1.4", "picomatch@2.3.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "picomatch", "version": "2.3.2", "severityWithCritical": "high" } ], "upgrade": {}, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 1, "targetFile": "/opt/scopear/app/package.json", "projectName": "package.json", "displayTargetFile": "/opt/scopear/app/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 1, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/local/lib/node_modules", "projectName": "lib", "displayTargetFile": "/usr/local/lib/node_modules", "hasUnknownVersions": false, "path": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 1, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/.npm-global/lib/node_modules", "projectName": "lib", "displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules", "hasUnknownVersions": false, "path": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 0, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "maven", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/local/bundle/gems/concurrent-ruby-1.3.7/lib/concurrent-ruby/concurrent", "projectName": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608:/usr/local/bundle/gems/concurrent-ruby-1.3.7/lib/concurrent-ruby/concurrent", "displayTargetFile": "/usr/local/bundle/gems/concurrent-ruby-1.3.7/lib/concurrent-ruby/concurrent", "hasUnknownVersions": false, "path": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608/scopear/scope-cms:3.47.2_07138dc.1608:/usr/local/bundle/gems/concurrent-ruby-1.3.7/lib/concurrent-ruby/concurrent" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 0, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "maven", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/share/java", "projectName": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608:/usr/share/java", "displayTargetFile": "/usr/share/java", "hasUnknownVersions": false, "path": "docker.io/scopear/scope-cms:3.47.2_07138dc.1608/scopear/scope-cms:3.47.2_07138dc.1608:/usr/share/java" } ] }